Greenstate Credit Union v. Hy-Vee, Inc.

• Court: District Court, D. Minnesota
• Decided: November 10, 2020
• Docket: 0:20-cv-00621
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA CIVIL NO. 20-621(DSD/DTS)

Greenstate Credit Union, on Behalf of Itself and All Others Similarly Situated,

Plaintiff,

v. ORDER

Hy-Vee, INC.,

Defendant.

Kate M. Baxter-Kauf, Esq. and Lockridge Grindal Nauen PLLP 100 Washington Ave South Suite 2200 Minneapolis, MN 55401, for plaintiff.

Paul G Karlsgodt, Esq. and Baker & Hostetler LLP 1801 California Street Suite 4400 Denver, CO 80202, for defendant.

This matter is before the court upon defendant Hy-Vee, Inc.’s motion to dismiss for improper venue or lack of personal jurisdiction, or, in the alternative, to transfer venue. Based on a review of the file, record, and proceedings herein, and for the following reasons, the motion is denied but the court will allow for an interlocutory appeal under 28 U.S.C. § 1292 should either party seek one.

BACKGROUND This class action dispute arises from defendant’s alleged negligence and violation of the Minnesota Plastic Card Security Act regarding its handling of a data breach that exposed sensitive payment card data. Compl. ¶¶ 62–93. Plaintiff contends that, from November 2018 to August 2019, computer hackers installed

malicious software (malware) on defendant’s point-of-sale systems at its fuel pumps, drive-thru coffee shops, and restaurants. Id. ¶ 2. This malware allowed the hackers to access Hy-Vee customers’ payment card data, including the cardholder’s name, credit or debit card number, and expiration date. Id. ¶ 1. Plaintiff alleges that defendant failed to implement adequate data security measures to ward off such data breaches and failed to timely discover and contain the data breach. Id. ¶¶ 3–4. Specifically, plaintiff asserts that defendant “refused to implement certain best practices, failed to upgrade critical security systems, used outdated point-of-sale systems, ignored warnings about the vulnerability of its computer network, and

disregarded and/or violated applicable industry standards.” Id. ¶ 3. Defendant’s alleged failures included hiring un- or under- qualified information technology management professionals, ignoring warnings that its systems were susceptible to attack by hackers, failing to implement protocols that would have protected against the installation of malware, failing to install adequate software to monitor unauthorized access to its data, and failing to comply with industry standards and Federal Trade Commission requirements regarding data security. Id. ¶¶ 32, 36–46. These failures, in turn, harmed plaintiff and other financial institutions that issue payment cards such as those compromised in the data breach. Id. ¶ 5. As a result of defendant’s alleged

failings, plaintiff and other financial institutions were required to cancel and reissue compromised cards and reimburse their members and customers for fraudulent charges. Id. ¶¶ 5, 49. Plaintiff is a federally chartered credit union with its principal place of business in North Liberty, Iowa. Id. ¶ 7. Plaintiff serves over 210,000 members at its twenty-six branch locations, all of which are located in Iowa. Courtney Decl. ¶ 2. Plaintiff has three primary ways through which a person can become a member. Id. ¶ 3. First, membership is open to anyone living or working in Iowa, or living or working in ten Illinois counties or three Wisconsin counties bordering Iowa. Id. Second, plaintiff’s membership is open to University of Iowa students, staff, and

alumni, some of whom “may live anywhere, including in Minnesota.” Id. ¶ 4. Third, membership is open to direct relatives of current GreenState Credit Union members. Id. ¶ 5. Of plaintiff’s approximately 210,000 members, 1,158 (or approximately half of one percent) have Minnesota addresses. Id. ¶ 7. Defendant is an Iowa corporation with its principal place of business in West Des Moines, Iowa. Compl. ¶ 12; Tingley Decl., ECF No. 22, ¶ 1. Defendant operates 264 stores in eight states. Tingley Decl. ¶ 1. Thirty-eight of those stores are in Minnesota and defendant is registered to do business here. Id. ¶ 3; Baxter- Kauf Decl. ¶ 2; id. Ex. A. During fiscal year 2019, 12.38% of defendant’s total revenue came from its Minnesota locations, and

as of April 2020, 13.77% of defendant’s workforce was assigned to Minnesota locations. Tingley Decl. ¶ 3. Defendant’s information technology department, which is responsible for maintaining its data security, and its chief technology officer, who is responsible for making decisions regarding defendant’s data and information security policies and practices, operate out of a facility near its headquarters in West Des Moines, Iowa. Id. ¶¶ 6–10. Defendant now moves to dismiss plaintiff’s complaint for lack of personal jurisdiction or, in the alternative, to transfer venue. Specifically, defendant contends that this court lacks general jurisdiction over it because it is not “at home” in Minnesota, and that this court lacks specific jurisdiction over it because all of

the relevant events took place in Iowa. Alternatively, defendant argues that this action should be transferred to the Central District of Illinois either pursuant to the first-filed rule or for the convenience of the parties and in the interest of justice.1

1 Defendant’s argument regarding the first-filed rule centers on three class action lawsuits that were filed against defendant in October and November of 2019 on behalf of consumers affected by the data breach. See ECF No. 22 Ex. C. Defendant and the various consumer plaintiffs agreed to consolidate those actions in the Central District of Illinois. Id. Plaintiff opposes defendant’s motion, arguing that this court has both general jurisdiction over defendant under Knowlton v. Allied Van Lines, Inc., 900 F.2d 1196 (8th Cir. 1990), and specific

jurisdiction over defendant. Plaintiff further contends that transfer is not warranted because the first-filed rule does not apply and transfer would not serve the convenience of the parties or the interests of justice.

DISCUSSION I. Personal Jurisdiction To survive a motion to dismiss for lack of personal jurisdiction, a plaintiff must establish a prima facie case that the forum state has personal jurisdiction over the defendant. See Stevens v. Redwing, 146 F.3d 538, 543 (8th Cir. 1998). In the absence of an evidentiary hearing, the court “must look at the

facts in the light most favorable to the nonmoving party and resolve all factual conflicts in favor of that party.” Dakota Indus., Inc. v. Dakota Sportswear, Inc., 946 F.2d 1384, 1387 (8th Cir. 1991) (citations omitted). The court “may look beyond the pleadings to determine whether personal jurisdiction exists, including reviewing affidavits and other exhibits.” Pederson v. Frost, 951 F.3d 977, 979 (8th Cir. 2020). A federal court may assume jurisdiction over a nonresident defendant “only to the extent permitted by the long-arm statute of the forum state and by the Due Process Clause.” Romak USA, Inc. v. Rich, 384 F.3d 979, 984 (8th Cir. 2004) (citation and internal quotation marks omitted). Because the Minnesota long-arm statute

“confers jurisdiction to the fullest extent permitted by the Due Process Clause,” the court need only consider due process requirements. Coen v. Coen, 509 F.3d 900, 905 (8th Cir. 2007) (citation omitted). Whether the exercise of personal jurisdiction over a defendant comports with due process depends on whether the defendant has sufficient contacts with Minnesota such that it “should reasonably anticipate being haled into court” here. World- Wide Volkswagen, 444 U.S. 286, 292 (1980); see also Digi–Tel Holdings, Inc. v. Proteq Telecomm. (PTE), Ltd., 89 F.3d 519, 522 (8th Cir. 1996). The court looks to a defendant’s contacts with the forum state to determine whether it has “purposefully avail[ed] itself of the privilege of conducting activities” in that state.

Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985). A defendant’s contacts with the forum state may allow the court to exercise jurisdiction that is either general or specific. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 472 (1985); see also Viasystems, Inc. v. EBM-Papst St. Georgen GmbH & Co., KG, 646 F.3d 589, 593 (8th Cir. 2011). Under the Due Process Clause, the court may exercise general jurisdiction “to hear ‘any and all claims against’ a defendant if its ‘affiliations with the State are so continuous and systematic as to render [it] essentially at home in the forum State.’” Creative Calling Sols., Inc. v. LF Beauty Ltd., 799 F.3d 975, 979 (8th Cir. 2015) (quoting Daimler AG v. Bauman, 571 U.S. 117, 127 (2014)). Alternatively, the court may exercise

specific jurisdiction when the defendant has sufficient minimum contacts with the forum state and the cause of action arises from those contacts. Id. at 979–90 (citing Daimler, 571 U.S. at 127)). II. Specific Jurisdiction Plaintiff argues that the court may exercise specific jurisdiction over defendant because it has sufficient minimum contacts with Minnesota and the cause of action arises from those contacts. Defendant asserts that, despite its contacts with Minnesota, plaintiff’s cause of action arises out of alleged wrongful conduct that occurred in Iowa, not Minnesota. The court agrees with defendant. To determine whether there is specific jurisdiction, the

court considers the following factors: “(1) the nature and quality of defendant’s contacts with the forum state; (2) quantity of contacts; (3) source and connection of the cause of action with those contacts; and to a lesser degree, (4) the interest of the forum state; and (5) the convenience of the parties.” Wessels, Arnold & Henderson v. Nat’l Med. Waste, Inc., 65 F.3d 1427, 1432 (8th Cir. 1995) (citations omitted). “The first three factors are of primary importance, and the last two are secondary factors.” Digi-Tel Holdings, 89 F.3d at 523. With regard to the first and second factors, defendant does not deny that it has some contacts with Minnesota. It operates thirty-eight stores in Minnesota — out of a total of 264 stores in

eight states — and generates 12.38% of its revenue here. In addition, 13.77% of its workforce is assigned to a Minnesota location. The third factor is where plaintiff’s argument regarding specific jurisdiction falls short. The gravamen of plaintiff’s complaint is that defendant failed to implement adequate data security measures, and plaintiff was harmed as a result. As explained above, all of the decisions regarding defendant’s data security are made by its chief technology officer and the information technology department, both of which are located in West Des Moines, Iowa. Further, the systems and infrastructure responsible for managing and monitoring defendant’s enterprise-

wide data security are located in Iowa. As such, the alleged wrongful conduct that led to plaintiff’s harm occurred in Iowa and plaintiff has not established that its cause of action is related to defendant’s Minnesota contacts. The court therefore lacks specific jurisdiction.2

2 The fourth and fifth factors either weigh in favor of declining the exercise of specific jurisdiction or are neutral. Although plaintiff alleges that some of its Minnesota members were harmed in the data breach, it is not clear that enough of its members live in Minnesota such that the state would have a strong interest in this litigation taking place here. And although III. General Jurisdiction Plaintiff also argues that the court may exercise general jurisdiction over defendant under Knowlton because it has

registered to do business here and therefore consented to personal jurisdiction here. Defendant asserts that the exercise of general jurisdiction in Minnesota would be improper because it is not “at home” here, and argues that recent decisions from the United States Supreme Court make clear that registering to do business in a state is not enough to confer general jurisdiction. Ultimately, the court agrees with plaintiff that Knowlton controls and the court may exercise general jurisdiction over defendant. A. “At Home” Analysis The exercise of general jurisdiction allows the court to adjudicate any cause of action against a defendant, regardless of whether that cause of action arose out of defendant’s contacts

with the forum state. See Creative Calling Sols., 799 F.3d at 979. Under the Due Process Clause, “[a] court may assert general jurisdiction over foreign (sister-state or foreign-country) corporations to hear any and all claims against them when their affiliations with the State are so ‘continuous and systematic’ as to render them essentially at home in the forum State.” Goodyear

Minnesota is not an inconvenient forum, because both plaintiff and defendant are principally located in Iowa, Iowa appears to be more a more convenient forum. Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011) (citing Int’l Shoe Co. v. State of Wash., Off. Unemployment Comp. & Placement et al., 326 U.S. 310, 317 (1946)).

The paradigmatic examples of where a corporation may fairly be considered at home are its place of incorporation and its principal place of business. Id. at 924; see also Daimler, 571 U.S. at 137. The Supreme Court has noted that it is only in an “exceptional case” that a “corporation’s operations in a forum other than its formal place of incorporation or principal place of business may be so substantial and of such a nature as to render the corporation at home in that State,” thus rendering the exercise of general jurisdiction appropriate. Daimler, 571 U.S. at 139 n.19. Defendant is neither incorporated in Minnesota nor is its principal place of business here. Further, given the proportion

of defendant’s business that occurs in Minnesota, this is not an exceptional case wherein defendant’s operations within Minnesota are “so substantial and of such a nature as to render it” at home here. Id. Because defendant cannot be considered at home in Minnesota, the exercise of general jurisdiction would be inconsistent with the Due Process Clause. B. Knowlton and Consent to Personal Jurisdiction Although the exercise of general jurisdiction here would be inconsistent with the Due Process Clause, “it is well-established that consent is an independent basis for the exercise of personal jurisdiction.” Am. Dairy Queen Corp. v. W.B. Mason Co., Inc., No. 18-cv-693, 2019 WL 135699, at *3 (D. Minn. Jan. 8, 2019) (citing

Ins. Corp. of Ireland v. Compagnie des Bauxites de Guinee, 456 U.S. 694, 703 (1982)). Both the Eighth Circuit and the Minnesota Supreme Court have held that corporations that are registered in and have an agent for service of process in Minnesota have consented to the exercise of general jurisdiction. See Knowlton, 900 F.2d at 1200; Rykoff-Sexton, Inc. v. Am. Appraisal Assocs., Inc., 469 N.W. 2d 88, 90-91 (Minn. 1991). There is no dispute that defendant is registered to do business in Minnesota and has a registered agent for service of process here. Defendant argues that Knowlton and Rykoff-Sexton are no longer good law after the Supreme Court’s more recent decisions in Goodyear, Daimler, and BNSF Railway Co. v. Tyrrell, 137 S. Ct.

1549. As discussed above, Goodyear and Daimler held that the exercise of general jurisdiction under the Due Process Clause may only be allowed in forums where the defendant can be considered “at home.” Goodyear, 564 U.S. at 924; Daimler, 571 U.S. at 127. The Court in BNSF explained that “in-state business ... does not suffice to permit the assertion of general jurisdiction over claims ... that are unrelated to any activity occurring in” the forum state. 137 S. Ct. at 1559. Neither Goodyear, Daimler, nor BNSF addressed whether consent pursuant to a state’s corporate registration statute is sufficient to confer general jurisdiction. BNSF expressly declined to

consider whether the defendant had consented to general jurisdiction because that issue was not addressed by the lower court. Id. That being said, these cases still raise serious questions as to whether the exercise of general jurisdiction over a defendant based on its registration to do business under state corporate registration statute’s such as Minnesota’s is proper. See Brown v. Lockheed Martin Corp., 814 F.3d 619, 639–40 (2d Cir. 2016). This is especially true given the fact that the Supreme Court in Daimler cautioned against giving too much weight to cases upon which both Knowlton and Rykoff-Sexton relied in reaching their decisions. Daimler, 571 U.S. at 139 n.19. The Second Circuit Court of Appeals explained why Goodyear,

Daimler, and BNSF call into question whether a defendant’s registration to do business in a state can confer general jurisdiction. In Brown, the Second Circuit stated that: [i]f mere registration and the accompanying appointment of an in-state agent — without an express consent to general jurisdiction — nonetheless sufficed to confer general jurisdiction by implicit consent, every corporation would be subject to general jurisdiction in every state in which it registered, and Daimler's ruling would be robbed of meaning by a back-door thief.

814 F.3d at 639–40. Other courts, including some in the Eighth Circuit, have also determined that implied consent under state corporate registration statutes is inconsistent with the Supreme Court’s more recent general jurisdiction jurisprudence. See Am. Dairy Queen Corp., 2019 WL 135699, at

*5 (collecting cases). Many courts, however, even after Daimler and Goodyear, have upheld the notion that a corporation consents to general jurisdiction by registering and appointing an agent for service of process in a state. See id. at *4 (collecting cases). Although defendant makes a compelling argument that Knowlton is inconsistent with the Supreme Court’s recent general jurisdiction decisions, the court agrees with other courts in this district that it is still bound by Knowlton. Accordingly, because defendant has consented to the exercise of general jurisdiction by registering to do business and appointing an agent for service of process in Minnesota,

defendant’s motion to dismiss for lack of personal jurisdiction must be denied. C. Interlocutory Appeal Under 28 U.S.C. § 1292(b) Because other courts have rejected Knowlton’s reasoning in light of more recent Supreme Court jurisprudence, the court requested supplemental briefing from the parties on whether granting an interlocutory appeal on this question would be appropriate. Interlocutory appeals should be granted sparingly, and only when such an appeal (1) “involves a controlling question of law,” (2) “as to which there is a substantial ground for difference of opinion,” and (3) “that an immediate appeal from the order may materially advance the

ultimate termination of the litigation.” 28 U.S.C. § 1292(b); see also White v. Nix, 43 F.3d 374, 376 (8th Cir. 1994). After review of the parties’ supplemental briefing, the court determines that allowing an interlocutory appeal is appropriate in this instance. First, whether the exercise of general jurisdiction under Knowlton is proper involves a controlling question of law. “A question is ‘controlling’ if error in its resolution would warrant reversal of a final judgment or dismissal.” Max Daetwyler Corp. v. Meyer, 575 F. Supp. 280, 282 (E.D. Penn. 1983), certified question answered sub nom. Max Daetwyler Corp. v. R. Meyer, 762 F.2d 290 (3d Cir. 1985).

Because the court has determined that it only has personal jurisdiction over defendant under Knowlton, whether Knowlton remains good law presents a controlling question of law. If this court were found to have lacked personal jurisdiction over the defendant on appeal, any decision by this court would be reversed and this action would be dismissed. Second, although controlling Eighth Circuit and Minnesota Supreme Court cases are in agreement, there is a substantial ground for difference of opinion as to whether those opinions remain good law in light of the recent Supreme Court decisions discussed above. Indeed, although ultimately determining that Knowlton and Rykoff-Sexton control, courts

in this district have recognized that those cases may no longer comport with the Supreme Court’s narrowing of general jurisdiction. See, e.g., Am. Dairy Queen Corp., 2019 WL 135699, at *6. Other courts within the Eighth Circuit have gone farther, holding that Knowlton is no longer controlling. See Alvarracin v. Volume Servs., Inc., No. 16-cv-6115, 2017 WL 1842701, at *2 (W.D. Mo. May 4, 2017); Beard v. SmithKline Beecham Corp., No. 4:15-cv-1833, 2016 WL 1746113, at *2 (E.D. Mo. May 3, 2016); Keeley v. Pfizer Inc., No. 4:15-cv-0583, 2015 WL 3999488, at *4 (E.D. Mo. July 1, 2015). Third, an interlocutory appeal would “materially advance the ultimate termination of the litigation.” 28 U.S.C.

§ 1292(b). Plaintiff argues that such an appeal would not materially advance the ultimate termination of this litigation because, in the event this court lacks jurisdiction, plaintiff would simply re-file this matter in the Central District of Illinois where both parties have consented to jurisdiction. In support of its argument, plaintiff cites this court’s decision in American Dairy Queen, in which the court determined that an interlocutory appeal on this same question was not appropriate because it would likely be a long, drawn-out process. 2019 WL 1767409, at *2. Although the same may be true here, the court determines

that the third prong of § 1292(b) is still met because “a decision on appeal may avoid protracted an expensive litigation.” Schwendimann v. Arkwright Advanced Coating, Inc., No. 11-cv-820, 2012 WL 5389674, at *5 (D. Minn. Nov. 2, 2012). Unlike in American Dairy Queen, which involved a single plaintiff and defendant, here plaintiff seeks to represent a class of hundreds of similarly situated financial institutions. Compl. ¶ 56. Any delay in this case caused by what could be a long interlocutory appeals process is outweighed by the fact that a “significant amount of time, funds, and effort will necessarily be expended by the parties and the court if this matter proceeds to resolution of the

substantive merits of plaintiff’s complaint.” Max Daetwyler Corp., 575 F. Supp. at 282. Because an interlocutory appeal would materially advance the ultimate resolution of this case in this forum, the third prong of § 1292(b) is met. Accordingly, the court would allow for an interlocutory appeal in the event either party wishes to seek one. IV. Venue Defendant also moves to transfer venue under the first-filed rule or 28 U.S.C. § 1404(a).3 Plaintiff opposes defendant’s

motion, arguing that the first-filed rule does not apply here and that transfer under § 1404(a) is not warranted. The court agrees with plaintiff. A. First-Filed Rule Under the first-filed rule, where parallel actions are filed in different jurisdictions, “the first court in which jurisdiction attaches has priority to consider the case.” U.S. Fire Ins. Co. v. Goodyear Tire & Rubber Co., 920 F.2d 487, 388 (8th Cir. 1990). The rule is not meant to be rigid or inflexible, but it does require that “substantially the same parties [are] litigating substantially the same issues” in the parallel actions. Wright v. Walden Univ., LLC, No. 16-cv-4037, 2017 WL 1435717, at *3 (D. Minn.

Apr. 21, 2017). Although there is some overlap in factual and legal issues between this action and the consumer class action pending in the Central District of Illinois, there is no overlap between the putative members of these class actions. Accordingly, application of the first-filed rule is inappropriate.

3 Defendant also moved to dismiss for improper venue. Because the court has determined that it has personal jurisdiction over defendant, the court denies its motion because venue is proper under 28 U.S.C. § 1391(b)(1). B. 28 U.S.C. § 1404(a) Under § 1404(a), a court may at its discretion transfer a case to any other district where the case could have been brought.

In determining whether transfer is appropriate, a court considers “(1) the convenience of the parties, (2) the convenience of the witnesses, and (3) the interests of justice.” Terra Int'l, Inc. v. Miss. Chem. Corp., 119 F.3d 688, 691 (8th Cir. 1997). These factors, however, are not exhaustive, and courts must make a “case- by-case evaluation of the particular circumstances at hand.” Id. When considering the interests of justice, the court looks to the following factors: “judicial economy, (2) the plaintiff’s choice of forum, (3) the comparative costs to the parties of litigating in each forum, (4) each party’s ability to enforce a judgment, (5) obstacles to a fair trial, (6) conflict of law issues, and (7) the advantages of having a local court determine questions of local

law.” Id. at 696. Defendant bears the burden of showing that plaintiff’s choice of forum is inconvenient because federal courts generally give “considerable deference to a plaintiff's choice of forum.” Id. at 695. Defendant contends that the convenience of the parties and witnesses warrants transfer of this action to the Central District of Illinois. Defendant argues that, because most of the witnesses would be traveling from plaintiff’s and defendant’s corporate headquarters, it would be easier for them to travel to the Central District of Illinois courthouse because it is geographically closer than the District of Minnesota courthouse. Defendant also maintains that the interests of justice favor transferring this

action. The court disagrees. Regarding the convenience of the parties and the witnesses, the court finds that the Central District of Illinois is no more convenient than the District of Minnesota. The driving distances between plaintiff’s and defendant’s headquarters and those two locations are roughly equivalent, and both locations have accessible international airports. Further, the factors the court considers regarding the interests of justice do not weigh heavily one way or the other. Of the factors listed above, only the first three have the potential to come into play here. The court finds that neither judicial economy nor the comparative costs to the parties of litigating in either forum weighs in favor of transfer.

This action and the consumer class action are distinct enough from each other that judicial economy is not affected by these actions continuing in different forums. Thus, the court will defer to plaintiff’s choice of forum in finding that transfer under § 1404(a) is not warranted. CONCLUSION Accordingly, based on the above, IT IS HEREBY ORDERED that: 1. The motion to dismiss or transfer venue [ECF No. 19] is

denied; and 2. The court has determined that an interlocutory appeal under 28 U.S.C. § 1292(b) would be appropriate in this matter; 3. In the event either party wishes to pursue an interlocutory appeal, it shall apply for interlocutory appeal to the Eighth Circuit Court of Appeals within ten days; and 4. In the event either party applies for an interlocutory appeal and the Eighth Circuit Court of Appeal permits the appeal, this matter shall be stayed pending resolution of the interlocutory appeal. Dated: November 10, 2020 s/David S. Doty David S. Doty, Judge United States District Court