In Re TJX Companies Retail SEC. Breach Litigation

564 F.3d 489
CourtCourt of Appeals for the First Circuit
DecidedMarch 30, 2009
Docket07-2828
StatusPublished
Cited by1 cases

This text of 564 F.3d 489 (In Re TJX Companies Retail SEC. Breach Litigation) is published on Counsel Stack Legal Research, covering Court of Appeals for the First Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
In Re TJX Companies Retail SEC. Breach Litigation, 564 F.3d 489 (1st Cir. 2009).

Opinion

United States Court of Appeals For the First Circuit

Nos. 07-2828, 08-1075, 08-1076

IN RE: TJX COMPANIES RETAIL SECURITY BREACH LITIGATION. __________

AMERIFIRST BANK and SELCO COMMUNITY CREDIT UNION,

Plaintiffs, Appellees/Cross-Appellants,

v.

TJX COMPANIES, INC., FIFTH THIRD BANK and FIFTH THIRD BANCORP,

Defendants, Appellants/Cross-Appellees.

APPEALS FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS [Hon. William G. Young, U.S. District Judge]

Before Boudin, Lipez and Howard, Circuit Judges.

Douglas H. Meal with whom Richard D. Batchelder, Jr. and Ropes & Gray LLP were on brief for TJX Companies, Inc. W. Breck Weigel with whom Robert N. Webner, Vorys, Sater, Seymour and Pease LLP, James R. Carroll, Nicholas I. Leitzes and Skadden, Arps, Slate, Meagher & Flom LLP were on brief for Fifth Third Bank and Fifth Third Bancorp. Joe R. Whatley, Jr. with whom Patrick J. Sheehan, Whatley Drake & Kallas, LLC, Archie C. Lamb, Jr., F. Inge Johnstone and The Lamb Firm, LLC were on brief for AmeriFirst Bank and SELCO Community Credit Union.

March 30, 2009 BOUDIN, Circuit Judge. Before us are cross-appeals

stemming from a well known incident: the theft from TJX computers

of customer credit and debit card information and the subsequent

fraudulent use of the information. See generally In re TJX Cos.

Retail Sec. Breach Litig., 493 F. Supp. 2d 1382 (D. Mass. 2007);

McMorris v. TJX, 493 F. Supp. 2d 158 (D. Mass. 2007). Law suits

ensued, this case--involving banks injured in the debacle--among

them.

In January 2007, TJX Companies, Inc. ("TJX"),

headquartered in Massachusetts and a major operator of discount

stores, revealed that its computer systems had been hacked. Credit

or debit card data for millions of its customers had been stolen.

Harm resulted not only to customers but, it appears, also to banks

that had issued the cards ("issuing banks"), which were forced to

reimburse customers for fraudulent use of the cards and incurred

other expenses.

In May 2007, AmeriFirst Bank, based in Alabama, filed

suit in the federal district court in Massachusetts against TJX

and, in addition, against an Ohio bank and its parent--Fifth Third

Bank and Fifth Third Bancorp (collectively "Fifth Third").1 Fifth

1 The suit against TJX included other named plaintiffs who have since settled. A second AmeriFirst suit, with another named plaintiff (SELCO--a credit union in Oregon), was filed against Fifth Third in the district court. The two cases were consolidated and, as allegations against Fifth Third in the second suit mirror those in the first, we refer only to "the complaint."

-2- Third served as "processing bank" for TJX transactions, receiving

the data from the customer's initial charge for a purchase and,

after high-speed verification from the issuing bank, authorizing

the charge. Visa and Mastercard each had a network and regime for

such purposes.

AmeriFirst's complaint, seeking class action status for

issuing banks, charged that both TJX and Fifth Third were variously

at fault: that TJX and Fifth Third failed to follow security

protocols prescribed by Visa and MasterCard to safeguard personal

and financial information; that the breaches occurred from July

2005 onward but were discovered and disclosed only later; and that

the issuing banks suffered losses from reimbursing customers for

fraud losses, monitoring customers accounts, and cancelling and

reissuing cards.

The multi-count complaint charged (1) negligence, (2)

breach of contract, (3) negligent misrepresentation, and (4) unfair

or deceptive practices under chapter 93A, Mass. Gen. Laws ch. 93A

(2008). The defendants moved to dismiss for failure to state a

claim. Fed. R. Civ. P. 12(b)(6). On October 12, 2007, the

district court dismissed the negligence and breach of contract

claims but refused to dismiss claims based on negligent

misrepresentation and chapter 93A. (A fifth claim, for "negligence

per se," was dismissed and is not at issue.) In re TJX Cos. Retail

Sec. Breach Litig., 524 F. Supp. 2d 83.

-3- Plaintiffs then moved to amend their complaint, seeking

to add a claim for conversion and also new facts to the chapter 93A

claim. On November 29, 2007, the district court provisionally

denied class status; if made final, this denial would in turn

defeat subject matter jurisdiction based on the minimal diversity

provisions of the Class Action Fairness Act, 28 U.S.C. § 1332

(2006). The court invited briefing as to whether, if class action

status were ultimately denied, it should transfer the case to state

court. In re TJX Cos. Retail Sec. Breach Litig., 246 F.R.D. 389.

On December 18, 2007, the court denied the motion to

amend the complaint, it made the denial of class status final, and

it ordered the transfer of the case to the Massachusetts Superior

Court. Although all but two of the claims had been dismissed, the

district court designated its pre-transfer rulings as "without

prejudice" to reconsideration by the state court. At defendants'

request, this court stayed the transfer pending review on appeal.

TJX and Fifth Third now appeal to this court, urging

principally that all claims against them should have been dismissed

with prejudice and that in any event transfer to the state court

was precluded by governing precedent. AmeriFirst and SELCO raise

standing and finality objections to defendants' appeal and ask for

affirmance of the transfer order; but by cross appeal, they say

that dismissal of their other claims was error and that both class

action status and the motion to amend should have been allowed.

-4- Jurisdiction, Standing and Finality. Although no party

has questioned it, we are compelled to consider first an oddity

that might seem to imperil subject matter jurisdiction.

Jurisdiction in the district court rested on the minimum diversity

provision available only for class actions, 28 U.S.C. § 1332, and

ultimately the district court ruled that class certification was

improper. So one might ask: how do the parties now get to litigate

on the merits whether specific counts did or did not state claims?

The answer is the district judge had provisional

jurisdiction to decide those merits issues--because whether class

action status was sustainable depended in part on what claims were

on the table. "In such cases it is both proper and necessary for

the trial court first to resolve the merits of the claim to the

extent necessary to allow the court to properly determine its own

jurisdiction." Augustine v. United States, 704 F.2d 1074, 1079

(9th Cir. 1983). See generally Bell v. Hood, 327 U.S. 678 (1946).

In the end, after disposing of standing and finality

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
564 F.3d 489, Counsel Stack Legal Research, https://law.counselstack.com/opinion/in-re-tjx-companies-retail-sec-breach-litigation-ca1-2009.