IN THE SUPERIOR COURT OF THE STATE OF DELAWARE
NATIONAL UNION FIRE INSURANCE COMPANY OF PITTSBURGH, PA.,
Plaintiff,
v. C.A. No. Nl4C-lO-16O MMJ (CCLD) TRUSTWAVE HOLDINGS, INC., TRUSTWAVE CORPORATION, TRUSTWAVE LTD., and AMBIRON TRUSTWAVE LTD.,
\J\é\./\./\J§/\/\J\J\,/\./£€\./
Defendants,
Submitted: March 21, 2016 Decided: May 3, 2016
Upon Defendants’ Motion to Dismiss Counts VII, VIII, XV, and XVI GRANTED
Upon Defendants’ Motion to Dismiss Counts XV-XXVI against Trustwave Holdings, Inc. GRANTED without prejudice
Upon Defendants’ Motion to Dismiss Counts XXIII-XXVI DENIED
OPINION
Robert J. Katzenstein, Esq., Smith, Katzenstein & Jenkins LLP, Christopher M. Kahler, Esq. (Argued), Scott L. Schmookler, Esq., Craig A. Jacobson, Esq., Gordon & Rees LLP, Attorneys for Plaintiff National Union Fire Insurance Company of Pittsburgh, Pa.
J0hn A. Elzuf0n, Esq., Peter C. McGivney, Esq., Elzufon Austin Ta’rlov & Mondell, P.A., Brian P. Kavanaugh, Esq. (Argued), William E. Arnault, Esq., Elizabeth A. Honig, Esq., Kirkland & E1lis LLP, Attorneys for Defendants Trustwave Holdings, Inc., Trustwave C0rp., Trustwave Ltd., and Ambiron Trustwave Ltd.
JOHNSTON, J.
the parties to that provision.B Forum selection clauses are presumptively va1id, unless the resisting party clearly shows that enforcement would be unreasonable or unjust, or that the clause is invalid for such reasons as fraud and overreaching.M The forum selection clause is unreasonable when its enforcement would seriously
impair a plaintiffs ability to pursue its cause of action. Mere inconvenience or
additional expense is not the test of unreasonableness.lé
If no exclusive forum selection clause exists, the court will consider which action is first-filed. When there is an earlier-filed action pending in a foreign jurisdiction, Delaware courts generally apply the Mc Wane doctrine. This doctrine favors granting a stay "when there is a prior action pending elsewhere, in a court capable of doing prompt and complete justice, involving the same parties and the
same issues. lf the Delaware action is considered first-filed, this Court examines
a motion under the traditional forum non conveniens framework. The Mc Wane line
of cases is not directly applicable. The Court will consider this precedent only by
way of analogy. There are competing forum selection clauses in this case. National Union’s
Amended Complaint implicates both fora. The parties to the 2011 contract agreed
_13+___1_?____ __.__ Id. 14 Ingres Corp. v. CA, Inc., 8 A.3d 1143, 1146 (Del. 2010). ‘5 L@veman, 2009 wL 847655, ar *2. ‘6 Id. 17 McWane Cast Iron Pipe Corp. v. McDowll-Wellman Engineering Co., 263 A.Zd 281, 283 (Del, 1970).
to a different forum from the 2006 contract. Any distinct claim arising out of the 2011 contract must be resolved in the Courts of England and Wales. The contracting parties should have been aware of possibly litigating claims in two jurisdictions.
National Union contends that the breach happened "sometime before December 20ll." lt is unclear when the alleged breach occurred. Thus, it is unclear which forum selection clause is triggered. The conduct may have been one continuous course of action or there may have been separate, distinct data breaches. The conduct may be identical or substantially similar. If the claims are severed before specifying the underlying factual allegations, separate litigation may result. This would be inefficient, a waste of judicial resources, and risk inconsistent judgments.
In Ashall Homes Ltd. v. ROK Entertainment Group Inc.,lg the Court of Chancery discussed policy reasons for not bifurcating claims in cases with different exclusive forum selection clauses. In Ashall, stockholders filed suit in Delaware against a corporation and its directors on the grounds that the stockholders were tricked into investing. The parties had simultaneously executed two sets of
agreements, both of which had English forum selection clauses. One forum
18 992 A.zd 1239 (Del. Ch. 2010)‘ 10
selection clause was mandatory. 19 The plaintiffs argued the other was permissive.z° Defendants moved to dismiss, citing the English forum selection clauses.
The Ashall Court granted Defendants’ motion to dismiss, citing the exclusive forum selection clauses:
[T]here is an important policy reason for adjudicating all of the disputes
relating to these two agreements in one court. Because the two agreements are intertwined, . . . bifurcating this dispute . . . would result
in obvious inefficiencies and confusion. . . . McWane, which generally confines litigation to one forum, serves the public’s interest in the orderly administration of justice by . . . reducing the risk of
conflicting verdicts.
. . . Under Mc Wane and other analogous doctrines, [] Plaintiffs ought to be bound for faimess and eff`lciency’s sake to litigate in one place.zl
At oral argument on the pending motions in this case, the parties discussed an undisclosed forensic report in Euronet’s possession. Defendants stated that the report will clarify when the alleged breaches occurred. Following discovery, if it appears that the alleged 2011 conduct was separate and distinct, and not in a continuous course from 2006 onward, the Court will consider whether to sever the 2011 claims to allow Trustwave to litigate in the Courts of England and Wales.
The Court finds that it is premature to dismiss the claims relating to the 2011 agreement at this time. Therefore, Trustwave’s Motion to Dismiss Counts XXIII
through XXVI is DENIED.
19 Id. ac1249. 2° 1d_at1249-50. ” 1a ar1251.
ll
CONCLUSION
Delaware law does not recognize a cause of action based on an implied warranty of accuracy. Therefore, Counts VII, VIII, XV, and XVI are hereby DISMISSED WITH PREJUDICE.
The Court finds that Plaintiff has failed to allege sufficient facts to establish a prima facie case against Trustwave Holdings, Inc. Therefore, Counts XV through XXVI are hereby DISMISSED WITHOUT PREJUDICE. Discovery will be permitted.
The Court holds that it is premature to determine whether the 20ll claims should be dismissed on the bases of venue and forum selection.
THEREFORE, Defendants’ Motion to Dismiss is hereby GRANTED in part and DENIED in part. Because of this ruling, the Court need not address Plaintiff’ s waiver argument.
IT IS SO ORDERED.
FACTUAL AND PROCEDURAL CONTEXT
This subrogation action stems from a credit card processing company’s data breach. A qualified security assessor allegedly failed to identify or prevent the breach. Plaintiff National Union Fire Insurance Company of Pittsburgh, Pa. ("National Union") insured Euronet Worldwide, Inc ("Euronet"). Euronet is a global provider of electronic payment and transaction processing services, including credit card transactions made from point of sale terrninals. Euronet transmits point of sale credit card data, including names and card numbers, to credit card companies.
Euronet protects the transmitted data on a highly-secured computer network system. Euronet designed its security measures to comply with the Payment Card Industry Data Security Standard ("PCI DSS") Requirements and Security Assessment Procedures promulgated by major credit card issuers (e.g., Visa and MasterCard). PCI DSS requires Euronet to have a qualified security assessor annually validate its compliance. The qualified security assessor tests Euronet’s systems to identify weaknesses and neutralize threats.
In 2006, Euronet and its subsidiaries entered into a series of contracts with Defendant Ambiron Trustwave Ltd., a qualified security assessor.l Pursuant to the
Free access — add to your briefcase to read the full text and ask questions with AI
IN THE SUPERIOR COURT OF THE STATE OF DELAWARE
NATIONAL UNION FIRE INSURANCE COMPANY OF PITTSBURGH, PA.,
Plaintiff,
v. C.A. No. Nl4C-lO-16O MMJ (CCLD) TRUSTWAVE HOLDINGS, INC., TRUSTWAVE CORPORATION, TRUSTWAVE LTD., and AMBIRON TRUSTWAVE LTD.,
\J\é\./\./\J§/\/\J\J\,/\./£€\./
Defendants,
Submitted: March 21, 2016 Decided: May 3, 2016
Upon Defendants’ Motion to Dismiss Counts VII, VIII, XV, and XVI GRANTED
Upon Defendants’ Motion to Dismiss Counts XV-XXVI against Trustwave Holdings, Inc. GRANTED without prejudice
Upon Defendants’ Motion to Dismiss Counts XXIII-XXVI DENIED
OPINION
Robert J. Katzenstein, Esq., Smith, Katzenstein & Jenkins LLP, Christopher M. Kahler, Esq. (Argued), Scott L. Schmookler, Esq., Craig A. Jacobson, Esq., Gordon & Rees LLP, Attorneys for Plaintiff National Union Fire Insurance Company of Pittsburgh, Pa.
J0hn A. Elzuf0n, Esq., Peter C. McGivney, Esq., Elzufon Austin Ta’rlov & Mondell, P.A., Brian P. Kavanaugh, Esq. (Argued), William E. Arnault, Esq., Elizabeth A. Honig, Esq., Kirkland & E1lis LLP, Attorneys for Defendants Trustwave Holdings, Inc., Trustwave C0rp., Trustwave Ltd., and Ambiron Trustwave Ltd.
JOHNSTON, J.
the parties to that provision.B Forum selection clauses are presumptively va1id, unless the resisting party clearly shows that enforcement would be unreasonable or unjust, or that the clause is invalid for such reasons as fraud and overreaching.M The forum selection clause is unreasonable when its enforcement would seriously
impair a plaintiffs ability to pursue its cause of action. Mere inconvenience or
additional expense is not the test of unreasonableness.lé
If no exclusive forum selection clause exists, the court will consider which action is first-filed. When there is an earlier-filed action pending in a foreign jurisdiction, Delaware courts generally apply the Mc Wane doctrine. This doctrine favors granting a stay "when there is a prior action pending elsewhere, in a court capable of doing prompt and complete justice, involving the same parties and the
same issues. lf the Delaware action is considered first-filed, this Court examines
a motion under the traditional forum non conveniens framework. The Mc Wane line
of cases is not directly applicable. The Court will consider this precedent only by
way of analogy. There are competing forum selection clauses in this case. National Union’s
Amended Complaint implicates both fora. The parties to the 2011 contract agreed
_13+___1_?____ __.__ Id. 14 Ingres Corp. v. CA, Inc., 8 A.3d 1143, 1146 (Del. 2010). ‘5 L@veman, 2009 wL 847655, ar *2. ‘6 Id. 17 McWane Cast Iron Pipe Corp. v. McDowll-Wellman Engineering Co., 263 A.Zd 281, 283 (Del, 1970).
to a different forum from the 2006 contract. Any distinct claim arising out of the 2011 contract must be resolved in the Courts of England and Wales. The contracting parties should have been aware of possibly litigating claims in two jurisdictions.
National Union contends that the breach happened "sometime before December 20ll." lt is unclear when the alleged breach occurred. Thus, it is unclear which forum selection clause is triggered. The conduct may have been one continuous course of action or there may have been separate, distinct data breaches. The conduct may be identical or substantially similar. If the claims are severed before specifying the underlying factual allegations, separate litigation may result. This would be inefficient, a waste of judicial resources, and risk inconsistent judgments.
In Ashall Homes Ltd. v. ROK Entertainment Group Inc.,lg the Court of Chancery discussed policy reasons for not bifurcating claims in cases with different exclusive forum selection clauses. In Ashall, stockholders filed suit in Delaware against a corporation and its directors on the grounds that the stockholders were tricked into investing. The parties had simultaneously executed two sets of
agreements, both of which had English forum selection clauses. One forum
18 992 A.zd 1239 (Del. Ch. 2010)‘ 10
selection clause was mandatory. 19 The plaintiffs argued the other was permissive.z° Defendants moved to dismiss, citing the English forum selection clauses.
The Ashall Court granted Defendants’ motion to dismiss, citing the exclusive forum selection clauses:
[T]here is an important policy reason for adjudicating all of the disputes
relating to these two agreements in one court. Because the two agreements are intertwined, . . . bifurcating this dispute . . . would result
in obvious inefficiencies and confusion. . . . McWane, which generally confines litigation to one forum, serves the public’s interest in the orderly administration of justice by . . . reducing the risk of
conflicting verdicts.
. . . Under Mc Wane and other analogous doctrines, [] Plaintiffs ought to be bound for faimess and eff`lciency’s sake to litigate in one place.zl
At oral argument on the pending motions in this case, the parties discussed an undisclosed forensic report in Euronet’s possession. Defendants stated that the report will clarify when the alleged breaches occurred. Following discovery, if it appears that the alleged 2011 conduct was separate and distinct, and not in a continuous course from 2006 onward, the Court will consider whether to sever the 2011 claims to allow Trustwave to litigate in the Courts of England and Wales.
The Court finds that it is premature to dismiss the claims relating to the 2011 agreement at this time. Therefore, Trustwave’s Motion to Dismiss Counts XXIII
through XXVI is DENIED.
19 Id. ac1249. 2° 1d_at1249-50. ” 1a ar1251.
ll
CONCLUSION
Delaware law does not recognize a cause of action based on an implied warranty of accuracy. Therefore, Counts VII, VIII, XV, and XVI are hereby DISMISSED WITH PREJUDICE.
The Court finds that Plaintiff has failed to allege sufficient facts to establish a prima facie case against Trustwave Holdings, Inc. Therefore, Counts XV through XXVI are hereby DISMISSED WITHOUT PREJUDICE. Discovery will be permitted.
The Court holds that it is premature to determine whether the 20ll claims should be dismissed on the bases of venue and forum selection.
THEREFORE, Defendants’ Motion to Dismiss is hereby GRANTED in part and DENIED in part. Because of this ruling, the Court need not address Plaintiff’ s waiver argument.
IT IS SO ORDERED.
FACTUAL AND PROCEDURAL CONTEXT
This subrogation action stems from a credit card processing company’s data breach. A qualified security assessor allegedly failed to identify or prevent the breach. Plaintiff National Union Fire Insurance Company of Pittsburgh, Pa. ("National Union") insured Euronet Worldwide, Inc ("Euronet"). Euronet is a global provider of electronic payment and transaction processing services, including credit card transactions made from point of sale terrninals. Euronet transmits point of sale credit card data, including names and card numbers, to credit card companies.
Euronet protects the transmitted data on a highly-secured computer network system. Euronet designed its security measures to comply with the Payment Card Industry Data Security Standard ("PCI DSS") Requirements and Security Assessment Procedures promulgated by major credit card issuers (e.g., Visa and MasterCard). PCI DSS requires Euronet to have a qualified security assessor annually validate its compliance. The qualified security assessor tests Euronet’s systems to identify weaknesses and neutralize threats.
In 2006, Euronet and its subsidiaries entered into a series of contracts with Defendant Ambiron Trustwave Ltd., a qualified security assessor.l Pursuant to the
contracts, Trustwave delegated some contractual responsibilities to Holdings.
l Ambiron Trustwave Ltd. now is Trustwave Ltd. Trustwave Holdings, Inc. ("Holdings")
formerly was Trustwave Corporation. For ease of reference, Defendants collectively will be called Trustwave unless specificity is required.
In February 201 l, the parties entered into a new contract. This contract encompassed and superseded all pri`or, piecemeal contracts. Most of the language stayed the same. Notab1y, the parties adopted a new forum selection clause. Delaware was the parties’ mandatory forum in the 2006 contract. The 2011 agreement changed the mandatory forum to the Courts of England and Wales.
Pursuant to the agreements, Trustwave performed yearly PCI DSS compliance assessments, vulnerability scan and management, and network penetration services. Trustwave had to: ensure that cardholder data, including stored and transmitted credit card primary account numbers (PAN), was sufficiently isolated and encrypted; certify that Euronet’s facilities and applications met PCI DSS requirements; and verify that anti-virus software was operable.
Trustwave performed at least three audits. On August 25, 2009, Trustwave performed a PCI DSS audit and a vulnerability scan, purportedly remediating all PCI DSS non-compliance issues. Trustwave produced a Report on Compliance, confirming full PCI DSS compliance. On January 25, 2010, Trustwave conducted another audit, again confirming PCI DSS compliance. On July l2, 20ll, Trustwave provided another Report on Compliance, again confirming that Euronet had complied with PCI DSS’s requirements. Euronet alleges it relied on
Trustwave’s continued representations that Euronet’s network was secure.
In December 20ll, Euronet discovered that a security breach occurred at some point during the contractual pen`ods. A software vendor failed to turn on necessary PAN encryption, leaving stored credit card data unencrypted. Additionally, malware found its way onto Euronet’s secured network, and swiped the unencrypted data. The breach affected approximately two million credit card numbers. Euronet paid out approximately $6 million in damages. National Union paid Euronet pursuant to its insurance policy. Now, National Union seeks to recover its payment from Trustwave. National Union alleges the breach would not have happened if Trustwave had not misled Euronet that its network was secure.
National Union filed this lawsuit on October l7, 2014. Trustwave moved to dismiss or, in the alternative, have National Union provide a more definite statement. On June lO, 2015, the Court denied Trustwave’s Motion to Dismiss, but required National Union to file a more definitive complaint listing all of the parties’ contracts.z National Union also was ordered to specify which claims it was bringing against which defendants.3
National Union filed its Amended Complaint on July 27, 20l5. Trustwave again moved to dismiss on the grounds of improper venue and failure to state a claim. National Union opposed, arguing, inter alia, that Trustwave waived its
venue argument by failing to raise it in its first Motion to Dismiss.
2 Defs.’ Mot. To Dismiss Hr’ g Tr. 2:9-3:8, Jun. lO, 2015 (Trans. ID 57520499). 3 Id. 3:9-11.
STANDA'RI?' OF RE_VIEW
Superior Court Civil Rule l2(b)(3) governs a motion to dismiss or stay on the basis of improper venue. The Court should give effect to private agreements’ terms to resolve disputes in a contractually-designated judicial forum, out of respect for the parties’ contractual designation." The Court can grant dismissal prior to discovery, on the basis of affidavits and documentary evidence, if the plaintiff cannot make out a prima facie case in support of its position.$ The Court generally will allow the plaintiff to take discovery when the plaintiff advances a non-frivolous legal argument that would defeat the motion if the facts turn out to be as alleged.6
In a Rule l2(b)(6) motion to dismiss, the Court must determine whether the claimant "may recover under any reasonably conceivable set of circumstances susceptible of proof."7 The Court must accept as true all well-pleaded allegations.g Every reasonable factual inference will be drawn in the non-moving party’s favor.9 lf the claimant may recover under that standard of review, the Court must deny the
motion to dismiss.l°
4 Loveman v. Nusmile, Inc., 2009 WL 847655, at *2 (Del. Super.).
5 Id. (citing Simon v. Navellier Series Fund, 2000 WL 1597890, at *4 (Del. Ch.)).
6 HealthTrio, Inc. v. Margules, 2007 WL 544156, at *2 (Del. Super.) (citing Simon, 2000 WL 1597890, at *4).
; Spence v. Funk, 396 A.2d 967, 968 (Del. l978).
Ia'.
9 Wilmington Sav. Fund. Soc j), F.S.B. v. Anderson, 2009 WL 597268, at *2 (Del. Super.) (citing Doe v. Cahill, 884 A.2d 45l, 458 (Del. 2005)).
‘° spen¢e, 396 A.2d @1¢968.
___ANALYSIS Implied Warranly of Accuracy
National Union’s implied warranty of accuracy claims fail as a matter of law for two reasons. First, National Union has failed to cite any Delaware authority supporting the existence of a cause of action for the implied warranty of accuracy.
Second, assuming an implied warranty of accuracy exists in Delaware, National Union’s claim still fails because both contracts contained identical language expressly disclaiming all warranties. The disclaimer states:
This agreement is a service agreement, and except as expressly
provided in this agreement, [Trustwave] disclaims all other
representations or warranties, express or implied, including, without
limitation, any warranties regarding quality, suitability,
merchantability, or fitness for a particular purpose (irrespective of any
course of dealing, custom or usage of trade) of any services or any goods or services provided incidental to the services provided under
this agreement.
Delaware’s Uniform Commercial Code allows parties to disclaim warranties. A warranty disclaimer must use language which in common understanding calls the buyer’s attention to the warranties’ exclusion stating there is no implied warranty.“
In this case, the disclaimer language validly excludes all implied warranties.
Therefore, Trustwave’s Motion to Dismiss Counts VII, VIII, XV, and XVI is
GRANTED.
“ 6 Dez_ C. § 2-316(3)(3).
Claims Against Holdings
Trustwave argues National Union failed to establish a prima facie case against Holdings because Plaintiff’s Amended Complaint fails to distinguish Holdings’ alleged conduct from the other Trustwave entities.
National Union only mentioned Holdings twice in its Amended Complaint, Paragraph fourteen states: "Upon information and belief, certain of Trustwave Ltd.’s contractual and professional duties and obligations were delegated to and
performed by Trustwave Holdings.’ This paragraph does not allege any specific conduct by Holdings. Paragraph twenty-one states: On January 25, 20l0, "Trustwave, operating under Trustwave Holdings, Inc." acknowledged that it had been retained to conduct a third party security assessment and determine whether Euronet [] satisfactorily met [PCI DSS] and other major payment card association security requirements related to the protection of cardholder data. "Trustwave, operating under Trustwave Holdings, Inc.," represented that it had "determined that Euronet [] has satisfactorily met the security requirements as of January 22, 20l0." This paragraph also does not allege any conduct undertaken by Holdings that could form the basis for liability. Reading paragraphs fourteen and twenty-one together, Trustwave argues National Union’s allegations merely create a circular relationship void of any
specific conduct on the part of Holdings, a distinct entity.
National Union argues it needs discovery to discern which entity conducted
the audits. National Union claims internal documents and employment records will determine whether Holdings engaged in any conduct for which it may be held liable. Trustwave stated at argument that it would not resist discovery relating to the various Trustwave relationships, including Holdings. The Court anticipates Trustwave will respond to all discovery requests regarding which entity undertook what responsibilities under the contracts.
The Court finds that Plaintiff has failed to allege sufficient facts to establish a prima facie clause of action against Holdings. Therefore, Defendants’ Motion to Dismiss Counts XV through XXVI against Trustwave Holdings, Inc. is GRANTED without prejudice. Discovery regarding which Trustwave entity performed what task will be permitted
Venue and Forum selection
The parties’ contracts contain contradicting forum selection clauses. The 2006 agreement and addenda provide:
This Agreement shall be governed by and construed in accordance with
the laws of the State of Delaware, without giving effect to conflict of
law principles. Each party hereto hereby agrees that any proceeding
relating to this Agreement and the transactions contemplated hereby
shall be brought solely in the state or federal court located in Delaware.
The 2011 agreement states:
This Agreement shall be governed by and construed in accordance with
English law, without giving effect to conflict of law principles. Each
party hereto hereby agrees that any proceeding relating to this Agreement and the transactions contemplated hereby shall be brought
solely in the Courts of England and Wales.
Trustwave argues that National Union’s Amended Complaint alleges four claims against Trustwave arising out of the 2011 agreement. Thus, those claims must be brought in the Courts of England and Wales.
National Union counters that it has not alleged conduct arising out of the 2011 agreement. Any 201 1 conduct referenced in its Amended Complaint was part of an ongoing pattern of misconduct. National Union contends it is entitled to file in Delaware based on claims arising out of the 2006 contract. Additionally, forcing National Union to litigate in the Courts of England and Wales creates inefficient, duplicative litigation.
Venue disputes generally arise When: (a) a party claims first-filed status; or (b) a party alleges another forum is better suited to hear the claims. National Union seeks to enforce both the 2006 forum selection clause and its first-filed status, preventing Trustwave from moving litigation to the Courts of England and Wales. Trustwave argues that the required forum for the 2011 claims is the Courts of England and Wales.
Consideration of a motion to dismiss a Delaware action, in favor of a foreign action, rests within the sound discretion of the court.lz When contracting parties
have agreed to an exclusive forum selection clause, Delaware Courts generally hold
12 Choice Hotels Intern., Inc. v. Columbus-Hunt Park DR. BNK Investors, L.L.C., 2009 WL
3335332, at *3 (Del. Ch.).