In Re: Heartland Payment Sys

• Court: Court of Appeals for the Fifth Circuit
• Decided: September 3, 2013
• Docket: 12-20648
• Status: Published

Opinion

Case: 12-20648 Document: 00512360374 Page: 1 Date Filed: 09/03/2013

IN THE UNITED STATES COURT OF APPEALS FOR THE FIFTH CIRCUIT United States Court of Appeals Fifth Circuit

FILED September 3, 2013

No. 12-20648 Lyle W. Cayce Clerk

LONE STAR NATIONAL BANK, N.A.; AMALGAMATED BANK; FIRST BANKERS TRUST COMPANY, NATIONAL ASSOCIATION; PENNSYLVANIA STATE EMPLOYEES CREDIT UNION; ELEVATIONS CREDIT UNION; O BEE CREDIT UNION; SEABOARD FEDERAL CREDIT UNION

Plaintiffs – Appellants v.

HEARTLAND PAYMENT SYSTEMS, INC.,

Defendant – Appellee

Appeal from the United States District Court for the Southern District of Texas

Before SMITH, GARZA, and SOUTHWICK, Circuit Judges. EMILIO M. GARZA, Circuit Judge: This case arises out of a group of hackers’ breach of Heartland Payment Systems, Inc.’s (“Heartland’s”) data systems, compromising confidential information belonging to customers of the plaintiff banks (together, the “Issuer Banks”). The district court dismissed the Issuer Banks’ claims. The Issuer Banks appeal only the dismissal of their negligence claim. We REVERSE and REMAND for proceedings consistent with this opinion. Case: 12-20648 Document: 00512360374 Page: 2 Date Filed: 09/03/2013

No. 12-20648

I The Issuer Banks have contracts with Visa and MasterCard that allow them to issue payment cards, including both credit and debit cards, to their customers. When a customer uses one of these cards at a merchant, the card information is first sent to a bank with whom the merchant contracts, known as the “acquirer bank.” The acquirer bank then sends the information to a processor, such as Heartland, and the processor sends the information to the issuer bank that issued the card. The approval or disapproval of use of the card is then transmitted back to the merchant through this chain. Two acquirer banks, KeyBank and Heartland Bank (together, the “Acquirer Banks”), are members of the Visa and MasterCard networks. Heartland contracted with the Acquirer Banks to process their transactions. These contracts required Heartland to comply with the Visa and MasterCard regulations, which contain mechanisms for Visa and MasterCard network members to recoup losses in the event of a data breach. Such a data breach occurred when hackers infiltrated Heartland’s data systems and stole payment card information. As a result, the Issuer Banks allege they incurred costs associated with replacing the compromised cards and reimbursing customers for fraudulent charges. Lacking a written contract with Heartland, the Issuer Banks asserted various claims, including negligence and contract claims as third party beneficiaries of Heartland’s contracts with other entities. As to the negligence claim, the parties disputed whether Texas or New Jersey law governs. They agreed the economic loss doctrine under Texas law would bar the Issuer Banks’ negligence claim, but disputed the applicability of

2 Case: 12-20648 Document: 00512360374 Page: 3 Date Filed: 09/03/2013

the economic loss doctrine under New Jersey law. The district court dismissed all the Issuer Banks’ claims, holding that even under New Jersey law, the economic loss doctrine would bar the Issuer Banks’ negligence claim. The district court reasoned that by entering into the web of contractual relationships established by Visa and MasterCard, the Issuer Banks contracted for the specific remedies afforded by the Visa and MasterCard regulations and thus could not bring common law tort claims against another participant in the same web. The Issuer Banks timely appealed the district court’s dismissal of their negligence claim against Heartland. II We review motions to dismiss under Federal Rule of Civil Procedure 12(b)(6) de novo, “accepting all well-pleaded facts as true and viewing those facts in the light most favorable to the plaintiff.” Highland Capital Mgmt., L.P. v. Bank of Am., Nat’l Ass’n, 698 F.3d 202, 205 (5th Cir. 2012) (quoting Bustos v. Martini Club Inc., 599 F.3d 458, 461 (5th Cir. 2010)). The well-pleaded facts must state a claim that is plausible on its face, and “[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 205 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). The Issuer Banks assert that under New Jersey law, the economic loss doctrine does not bar their negligence claim. We agree. The economic loss doctrine generally limits a plaintiff seeking to recover purely economic losses, such as lost profits, to contractual remedies. See generally Spring Motors Distribs., Inc. v. Ford Motor Co., 489 A.2d 660, 671–72 (N.J. 1985). The New Jersey Supreme Court explained:

3 Case: 12-20648 Document: 00512360374 Page: 4 Date Filed: 09/03/2013

Generally speaking, tort principles, such as negligence, are better suited for resolving claims involving unanticipated physical injury, particularly those arising out of an accident. Contract principles, on the other hand, are generally more appropriate for determining claims for consequential damage that the parties have, or could have, addressed in their agreement. Id. at 672. The Court reasoned that “[a]s between commercial parties, . . . the allocation of risks in accordance with their agreement better serves the public interest than an allocation achieved as a matter of policy without reference to that agreement.” Id. at 671. Nevertheless, the Court held the economic loss doctrine does not bar tort recovery in every case where the plaintiff suffers economic harm without any attendant physical harm in People Express Airlines, Inc. v. Consolidated Rail Corp., 495 A.2d 107 (N.J. 1985). There, a fire at a railroad freight yard resulted in the evacuation of an adjacent terminal at Newark International Airport. Id. at 108. Employees of the plaintiff, an airline based in the evacuated terminal, could not return to the terminal for twelve hours, causing the plaintiff to suffer economic losses as a result of canceled flights and lost reservations. Id. The plaintiff sued the railroad defendant for negligence, among other causes of action. Id. at 109. After a survey of the economic loss doctrine and its exceptions, the Court articulated how the doctrine operates in New Jersey: We hold therefore that a defendant owes a duty of care to take reasonable measures to avoid the risk of causing economic damages, aside from physical injury, to particular plaintiffs or plaintiffs comprising an identifiable class with respect to whom defendant knows or has reason to know are likely to suffer such damages from its conduct. . . . We stress that an identifiable class of plaintiffs is not simply a foreseeable class of plaintiffs. . . . An identifiable class of plaintiffs

4 Case: 12-20648 Document: 00512360374 Page: 5 Date Filed: 09/03/2013

must be particularly foreseeable in terms of the type of persons or entities comprising the class, the certainty or predictability of their presence, the approximate numbers of those in the class, as well as the type of economic expectations disrupted. We recognize that some cases will present circumstances that defy the categorization here devised to circumscribe a defendant’s orbit of duty, limit otherwise boundless liability and define an identifiable class of plaintiffs that may recover. In these cases, the courts will be required to draw upon notions of fairness, common sense and morality to fix the line limiting liability as a matter of public policy, rather than an uncritical application of the principle of particular foreseeability. Id. at 116 (internal citations omitted). Accordingly, under New Jersey law, the economic loss doctrine does not bar tort recovery where the defendant causes an identifiable class of plaintiffs to which it owes a duty of care to suffer economic loss that does not result in boundless liability. Id. The parties rely heavily on two federal cases interpreting the economic loss doctrine under New Jersey law. In the first, Dynalectric Co. v. Westinghouse Electric Corp., a contractor, Westinghouse Electric Corporation (“Westinghouse”), sub-contracted work to Dick Corporation (“Dick”) and Davy McKee Corporation (“Davy”). 803 F. Supp. 985, 986–87 (D.N.J. 1992). Dick then sub-subcontracted work to Dynalectric Corporation (“Dynalectric”). Id. at 987. Westinghouse and Dick’s contract contained an arbitration clause and a procedure for filing claims. Id. Dick and Dynalectric’s contract incorporated the terms of Dick’s contract with Westinghouse, expressly giving Dynalectric all remedies afforded to Dick by that contract and requiring Dick to submit to Westinghouse any of Dynalectric’s claims. Id. Dynalectric suffered economic loss due to actions of Westinghouse and Davy. Id. at 987. Dick filed a demand

5 Case: 12-20648 Document: 00512360374 Page: 6 Date Filed: 09/03/2013

for arbitration, incorporating Dynalectric’s claims. Id. at 988. Separately, Dynalectric sued Westinghouse and Davy for negligence. Id. The Dynalectric court interpreted People Express as allowing tort recovery for economic losses only when the plaintiff lacks another remedy. Id. at 991 (“[W]hen a party has suffered economic loss because of the negligent actions of another, and the party has another means of redress against the alleged tortfeasor, that party may not assert the identical claims for identical damages under tort theories.”). Dynalectric relied on the principle articulated in People Express that “one objective of tort law is to ensure that innocent victims have avenues of legal redress, absent a contrary, overriding public policy.” Id. (quoting People Express, 495 A.2d at 111). Despite the lack of a contract between Dynalectric and either of the defendants, the court found Dynalectric had another means of redress by way of the arbitration proceedings. Id. at 992. Accordingly, the court held the negligence claims were barred by the economic loss doctrine. Id. at 993. In the other federal case the parties rely on, Consult Urban Renewal Development Corp. v. T.R. Arnold & Associates, Inc., a developer contracted with a manufacturer to buy housing units. 2009 WL 1969083, at *1 (D.N.J. July 1, 2009). The manufacturer had a contract with an inspection company to abide by New Jersey law requiring inspection and certification. Id. The housing units were defective, and the developer brought a negligence claim against the inspector. Id. The court held the economic loss doctrine was inapplicable “because the rule typically applies to the sale of goods, not the provision of services.” Id. at *4. The court further reasoned that the policy rationale behind the doctrine is that contract law is better suited for certain claims because

6 Case: 12-20648 Document: 00512360374 Page: 7 Date Filed: 09/03/2013

parties can negotiate the allocation of risk, but the builder was at most a third- party beneficiary to the contract between the manufacturer and the inspector, so it did not have an opportunity to negotiate the terms of that agreement. Id. The court held the inspector owed a duty to the builder under New Jersey law governing the liability of professionals to third parties who rely on their services. Id. Lastly, we note the Third Circuit, predicting how the New Jersey Supreme Court would address the case before it, held the economic loss doctrine prevented a commercial buyer from bringing a products liability claim against a commercial seller. Travelers Indem. Co. v. Dammann & Co., 594 F.3d 238, 248 (3d Cir. 2010). The Third Circuit applied the economic loss doctrine even though New Jersey statutory law allows product liability claims where the product causes physical damage to property other than the product itself, and the product in that case caused such damage. Id. at 247–48. The Third Circuit explained that “New Jersey courts have consistently held that contract law is better suited to resolve disputes between parties where a plaintiff alleges direct and consequential losses that were within the contemplation of sophisticated business entities with equal bargaining power and that could have been the subject of their negotiations.” Id. at 248. Because the commercial parties had equal bargaining power in conducting the sale, the court held the economic loss doctrine applied. Id. Turning to the case sub judice, we hold the economic loss doctrine under New Jersey law does not preclude the Issuer Banks’ negligence claim against Heartland at the motion to dismiss stage. First, the Issuer Banks constitute an “identifiable class” as contemplated by People Express. 495 A.2d at 116.

7 Case: 12-20648 Document: 00512360374 Page: 8 Date Filed: 09/03/2013

Heartland had reason to foresee the Issuer Banks would be the entities to suffer economic losses were Heartland negligent. See id. The identities, nature, and number of the victims are easily foreseeable, as the Issuer Banks are the very entities to which Heartland sends payment card information. See id. Furthermore, Heartland would not be exposed to “boundless liability,” but rather to the reasonable amount of loss from a limited number of entities. Id. Accordingly, even absent physical harm, Heartland may owe the Issuer Banks a duty of care and may be liable for their purely economic losses. See id.; Carter Lincoln-Mercury, Inc., Leasing Div. v. EMAR Grp., Inc., 638 A.2d 1288, 1294 (N.J. 1994) (holding economic loss doctrine no bar to tort claim regardless of physical harm “if the plaintiff was a member of an identifiable class that the defendant should have reasonably foreseen was likely to be injured by the defendant’s conduct” (citing People Express, 495 A.2d at 116)). Second, viewing the pleadings in the light most favorable to the Issuer Banks, in the absence of a tort remedy, the Issuer Banks would be left with no remedy for Heartland’s alleged negligence, defying “notions of fairness, common sense and morality.” People Express, 495 A.2d at 116; see Carter Lincoln- Mercury, 638 A.2d at 1294 (“Once the foreseeability of an injured party is established, we must decide whether considerations of fairness and policy warrant the imposition of a duty.”). Unlike the contracts in Dynalectric, 803 F. Supp. at 987, it is not clear whether Heartland’s contracts with the Acquirer Banks, which require Heartland to comply with Visa and MasterCard rules and regulations, provide the Issuer Banks with compensation mechanisms for losses that may be caused by Heartland’s negligence. Though Visa and MasterCard investigated Heartland’s data breach and directed its members to avoid using

8 Case: 12-20648 Document: 00512360374 Page: 9 Date Filed: 09/03/2013

Heartland’s services for a period of time, it is not clear that Heartland can take part in the dispute-resolution mechanisms solely by virtue of agreeing with the Acquirer Banks to be bound by the regulations. Further, it is unclear whether Heartland has contracts with Visa and MasterCard, let alone what the contents of such contracts may be. Though the district court permitted some discovery on the existence of these contracts at the motion to dismiss stage, the results were inconclusive and thus do not aid our inquiry. This uncertainty in the record leaves open the issue of the Issuer Banks’ bargaining power with respect to Heartland’s participation in the Visa and MasterCard networks. See Consult Urban, 2009 WL 1969083 at *4. While it seems the Issuer Banks’ remedies vis-à-vis the Acquiring Banks under the regulations are clear because both the Issuer Banks and the Acquirer Banks are members of the Visa and MasterCard networks, any contractual remedies the Issuer Banks have to recoup losses caused by Heartland are not evident. As such, it is not clear that the allocation of risk “could have been the subject of . . . negotiations” between the Issuer Banks and Heartland by way of contracts with Visa and MasterCard. Travelers Indem., 594 F.3d at 248. Mindful that “[t]he New Jersey Supreme Court has long been a leader in expanding tort liability,” Hakimoglu v. Trump Taj Mahal Assocs., 70 F.3d 291, 295 (3d Cir. 1995) (Becker, J., dissenting), and in light of the lack of a developed record illuminating any contractual remedies available to the Issuer Banks, we hold, under the alleged facts of this case, the economic loss doctrine does not bar the Issuer Banks’ negligence claim at this stage of the litigation.

9 Case: 12-20648 Document: 00512360374 Page: 10 Date Filed: 09/03/2013

III Heartland asserts that even if it owes the Issuer Banks a duty of care under People Express and the economic loss doctrine does not bar the Issuer Banks’ negligence claim at this stage of the litigation, we should affirm the district court on any of four grounds: (1) the Issuer Banks are bound by the allegation in their complaint that Heartland has contracts with Visa and MasterCard, so they should be limited to the contractual remedies available through the Visa and MasterCard networks; (2) Texas law, not New Jersey law, is controlling; (3) the Issuer Banks fail to state a claim under Federal Rule of Civil Procedure 8(a); and (4) some of the Issuer Banks are collaterally estopped from pursuing this negligence claim because the district court’s disposition of their separate claim against the Acquirer Banks involved the same issue. Though “[w]e are free to uphold the district court’s judgment on any basis that is supported by the record,” Zuspann v. Brown, 60 F.3d 1156, 1160 (5th Cir. 1995), we decline to decide these complex issues as they are better addressed by the district court in the first instance. See U.S. ex rel. Branch Consultants v. Allstate Ins. Co., 560 F.3d 371, 381 (5th Cir. 2009) (remanding so district court can consider issues in first instance) (citing Breaux v. Dilsaver, 254 F.3d 533, 538 (5th Cir. 2001) (“Although this court may decide a case on any ground that was presented to the trial court, we are not required to do so.”)). IV For these reasons, we REVERSE and REMAND for proceedings consistent with this opinion.