Sovereign Bank v. BJ Wholesale Club

Court of Appeals for the Third Circuit·Decided July 16, 2008·No. 06-3392·Published

Opinion

Opinions of the United

2008 Decisions States Court of Appeals for the Third Circuit

7-16-2008

Sovereign Bank v. BJ Wholesale Club Precedential or Non-Precedential: Precedential

Docket No. 06-3392

Follow this and additional works at: http://digitalcommons.law.villanova.edu/thirdcircuit_2008

Recommended Citation "Sovereign Bank v. BJ Wholesale Club" (2008). 2008 Decisions. Paper 759. http://digitalcommons.law.villanova.edu/thirdcircuit_2008/759

This decision is brought to you for free and open access by the Opinions of the United States Court of Appeals for the Third Circuit at Villanova University School of Law Digital Repository. It has been accepted for inclusion in 2008 Decisions by an authorized administrator of Villanova University School of Law Digital Repository. For more information, please contact Benjamin.Carlson@law.villanova.edu.

PRECEDENTIAL

UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT

Nos. 06-3392/3405

SOVEREIGN BANK,

Appellant No: 06-3392

v.

BJ'S WHOLESALE CLUB, INC.;

FIFTH THIRD BANCORP

PENNSYLVANIA STATE EMPLOYEES CREDIT UNION Appellant No: 06-3405

v.

FIFTH THIRD BANK;

BJ'S WHOLESALE CLUB, INC.

BJ'S WHOLESALE CLUB, INC.

Defendant/Third-Party Plaintiff

v.

INTERNATIONAL BUSINESS MACHINES CORPORATION, INC.

Third-Party Defendant

Appeals from the United States District Court for the Middle District of Pennsylvania (Civ. Nos. 05-cv-01150/04-cv-01554)

District Judge: Hon. William W. Caldwell

Argued: June 19, 2007

Before: McKEE, FISHER and CHAGARES, Circuit Judges

(Opinion filed: July 16, 2008)

JOSEPH WOLFSON, ESQ. (Argued) STACEY A. SCRIVANI, ESQ. Stevens & Lee 620 Freedom Business Center P.O. Box 62330 King of Prussia, PA 19406 Attorneys for appellant, Sovereign Bank

DONALD B. KAUFMAN, ESQ. (Argued) DEVIN CHWASTYK, ESQ. McNees Wallace & Nurick LLC 100 Pine Street

P.O. Box 1166 Harrisburg, PA 17108 Attorneys for appellant, Pennsylvania State Employees Credit Union

JAMES W. PRENDERGAST, ESQ. (Argued) JENNIFER L. CARPENTER, ESQ. Wilmer Cutler Pickering Hale and Dorr LLP 60 State Street Boston, MA 02109

GORDON PEARSON, ESQ. MARIO J. WEBER, ESQ. Wilmer Cutler Pickering Hall and Dorr LLP 1875 Pennsylvania Ave., NW Washington, D.C. 2006

RICHARD L. KREMNICK, ESQ. CHRISTOPHER A. LEWIS, ESQ. LEWIS W. SCHLOSSBERG, ESQ. Blank Rome LLP One Logan Square 18th & Cherry Streets Philadelphia, PA 19103 Attorneys for appellee, BJ’s Wholesale Club, Inc.

W. BRECK WEIGEL, ESQ. (Argued) Vorys, Sater, Seymour & Pease LLP 221 East Fourth Street Cincinnati, OH 45202

ANDREW L. SWOPE, ESQ. ABRAM D. BURNETT III, ESQ. Kirkpatrick & Lockhart Preston Gates Ellis LLP 17 N. Second Street, 18th Floor Harrisburg, PA 17101 Attorneys for appellee, Fifth Third Bank

OPINION

McKEE, Circuit Judge.

In these consolidated appeals, Sovereign Bank and the Pennsylvania State Employees Credit Union appeal orders dismissing claims that arose from the theft of certain credit card information from a retailer’s computer files. For the reasons that follow, we will reverse in part, and affirm those orders in part.

I. BACKGROUND

These consolidated appeals involve two law suits that arose from the theft of credit card information from the computer files of a prominent retailer. Visa U.S.A., Inc., is a

corporation, comprised of an association of financial institutions, which operates a credit card payment system known as “Visa.” Sovereign Bank and the Pennsylvania State Employees Credit Union (“PSECU”) are both members of the Visa network. Sovereign and PSECU have a Membership Agreement with Visa that allows them to issue Visa cards to their respective customers and members. Within the Visa network, Sovereign and PSECU are referred to as “Issuers,” which means that they issue Visa cards to cardholders pursuant to the contracts they enter into with them.

Fifth Third Bank is also a member of the Visa network, and it also has a Membership Agreement with Visa. Within the network, Fifth Third is referred to as an “Acquirer,” which means that Fifth Third enters into contractual relationships with businesses that agree to accept Visa cards as payment for their goods and services (“Merchants”). Acquirers process those

transactions on behalf of the Merchants. BJ’s Wholesale Club, Inc., is a Merchant. Accordingly, Fifth Third and BJ’s have entered into a Merchant Agreement. Although Merchants participate in the Visa network, they are not members. Only financial institutions are eligible for membership. Therefore, Merchants have no contractual relationship directly with Visa.

Every time a cardholder uses a Visa card to pay a Merchant for goods or services, the Issuer, Acquirer and Merchant must interact to process and complete the transaction. The Merchant’s computer scanners first “read” the “Cardholder Information” contained in the magnetic stripe on the back of Visa cards as they are swiped through the familiar terminal at the checkout. The Merchant then sends the pertinent account information through the Visa network to the Issuer. The Issuer reviews the Cardholder Information and, assuming the card is valid with sufficient available credit, the Issuer authorizes the

transaction, and so notifies the Merchant. Upon receiving that notification, the Merchant completes the transaction with the cardholder, and then forwards the receipt to the Acquirer who pays the Merchant pursuant to their agreement. The Acquirer then notifies the Issuer that payment has been received, and the Issuer pays the Acquirer and charges the cardholder.

Visa has created an extensive set of “Operating Regulations” to both govern and facilitate transactions involving Visa cards.1 Those Regulations address virtually every aspect of the Visa payment system, and impose both general and specific requirements on participants in the network.

The disputes in these appeals center on certain

security regulations including the Cardholder Information Security Program (“CISP”). The CISP provisions apply to Issuers and Acquirers and include broad security requirements intended to protect Cardholder Information. Those requirements include a prohibition against retaining or storing the data encoded in the familiar magnetic stripe on the back of credit cards, i.e., Cardholder Information, after a consumer transaction is completed.

One provision of the Operating Regulations, entitled “Enforcement,” defines procedures by which Visa can enforce compliance with the Operating Regulations. That provision expressly allows Visa to take specified remedial actions against Members who do not comply with the Operating Regulations, including levying fines and penalties. Enforcement actions can be appealed to Visa’s Board of Directors, but the Board’s decision is final. The Operating Regulations give Visa, and

only Visa, the right to interpret and enforce the Operating Regulations, and only Visa can determine whether a violation of the Operating Regulations has occurred.

The Operating Regulations also impose extensive security requirements on Issuers and Acquirers. Section 2.3 of the Operating Regulations requires Issuers and Acquirers to ensure that their agents, service providers and Merchants comply with the Operating Regulations.

The Visa Operating Regulations also include comprehensive provisions for resolving disputes between Visa members. These provisions allow members to challenge disputed charges through “chargeback” and representment procedures,2 in accordance with risk allocation judgments made by Vi

sa. Disputes about the use of these procedures are resolved by arbitration.

Free access — add to your briefcase to read the full text and ask questions with AI

Sovereign Bank v. BJ Wholesale Club, (3d Cir. 2008).

Sovereign Bank v. BJ Wholesale Club (Sovereign Bank v. BJ Wholesale Club) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related

Robins Dry Dock & Repair Co. v. Flint
275 U.S. 303 (Supreme Court, 1927)
Conley v. Gibson
355 U.S. 41 (Supreme Court, 1957)
Anderson v. Liberty Lobby, Inc.
477 U.S. 242 (Supreme Court, 1986)
Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Allegheny General Hospital Allegheny Valley Hospital Armstrong County Memorial Hospital Canonsburg General Hospital Carbon- Schuylkill Community Hospital, Inc., D/B/A Miners Memorial Medical Center Chambersburg Hospital Forbes Regional Hospital Hazleton--St. Joseph Medical Center Lehigh Valley Hospital Muhlenberg Hospital Center Northeastern Pennsylvania Corporation, D/B/A Hazleton General Hospital Saint Luke's Hospital of Bethlehem Saint Luke's -- Allentown Campus St. Luke's Quakertown Hospital Saint Vincent Health Center Waynesboro Hospital v. Philip Morris, Inc. R.J. Reynolds Tobacco Company Brown & Williamson Tobacco Corporation B.A.T. Industries, Plc the American Tobacco Company, Inc., C/o Brown & Williamson Tobacco Corporation Lorillard Tobacco Company Liggett Group, Inc. United States Tobacco Company Tobacco Institute, Inc. The Council for Tobacco Research--Usa, Inc. Smokeless Tobacco Council, Inc. Hill & Knowlton, Inc., Allegheny General Hospital Allegheny Valley Hospital Armstrong County Memorial Hospital Canonsburg General Hospital Carbon-Schuylkill Community Hospital, Inc., D/B/A Miners Memorial Medical Center Chambersburg Hospital Forbes Regional Hospital Hazleton--St. Joseph Medical Center Lehigh Valley Hospital Muhlenberg Hospital Center Northeastern Pennsylvania Corporation, D/B/A Hazleton General Hospital Saint Luke's Hospital of Bethlehem Saint Luke's--Allentown Campus St. Luke's Quakertown Hospital Saint Vincent Health Center Waynesboro Hospital, in 99-4024, Armstrong County Memorial Hospital Carbon-Schuylkill Community Hospital, Inc., D/B/A Miners Memorial Medical Center Chambersburg Hospital Hazleton--St. Joseph Medical Center Lehigh Valley Hospital Muhlenberg Hospital Center Northeastern Pennsylvania Corporation, D/B/A Hazleton General Hospital Saint Luke's Hospital of Bethlehem Saint Luke's-- Allentown Campus St. Luke's Quakertown Hospital Saint Vincent Health Center Waynesboro Hospital, in 00-3101, Allegheny General Hospital Allegheny Valley Hospital Canonsburg General Hospital Forbes Regional Hospital, in 00-3102
228 F.3d 429 (Third Circuit, 2000)
Cristen M. Gleason v. Norwest Mortgage, Inc
243 F.3d 130 (Third Circuit, 2001)
Phillips v. County of Allegheny
515 F.3d 224 (Third Circuit, 2008)
In Re TJX Companies Retail Security Breach Litigation
524 F. Supp. 2d 83 (D. Massachusetts, 2007)
Bilt-Rite Contractors, Inc. v. Architectural Studio
866 A.2d 270 (Supreme Court of Pennsylvania, 2005)
Aikens v. Baltimore and Ohio R. Co.
501 A.2d 277 (Supreme Court of Pennsylvania, 1985)
Walter v. Magee-Womens Hospital of UPMC Health System
876 A.2d 400 (Superior Court of Pennsylvania, 2005)
Sirianni v. Nugent Bros., Inc.
506 A.2d 868 (Supreme Court of Pennsylvania, 1986)
Limbach Co., LLC v. City of Philadelphia
905 A.2d 567 (Commonwealth Court of Pennsylvania, 2006)
Torchia on Behalf of Torchia v. Torchia
499 A.2d 581 (Supreme Court of Pennsylvania, 1985)
Scarpitti v. Weborg
609 A.2d 147 (Supreme Court of Pennsylvania, 1992)
Adams v. Copper Beach Townhome Communities, L.P.
816 A.2d 301 (Superior Court of Pennsylvania, 2003)