FIRST CHOICE FEDERAL CREDIT UNION v. THE WENDY'S COMPANY
2:16-cv-00506
W.D. Pa.Feb 13, 2017Background
- 26 financial institutions (individual FIs and associations) sued Wendy’s after a reported data breach beginning Oct 2015 that used a third‑party vendor credential to install malware and exfiltrate payment card data from ~1,000 restaurants. Plaintiffs allege Wendy’s knew of a breach by Dec 2015 and unauthorized charges occurred by Jan 2016.
- Plaintiffs (FI Plaintiffs and Association Plaintiffs) filed a Consolidated Amended Class Action Complaint asserting negligence, negligence per se (based on FTC Section 5 and similar state statutes), violation of the Ohio Deceptive Trade Practices Act (ODTPA), and requests for declaratory and injunctive relief.
- Defendants moved to dismiss under Rule 12(b)(6), arguing among other things: choice‑of‑law/economic loss doctrine bars tort recovery, no common law duty to safeguard or notify, Section 5 cannot support negligence per se, and deficiencies in ODTPA and equitable claims.
- The Magistrate Judge applied the Twombly/Iqbal plausibility standard, accepted the complaint’s factual allegations as true at this stage, and noted choice‑of‑law was premature because the Court found Plaintiffs’ property‑damage theory (computer data as property) at least plausible.
- The Magistrate Judge recommended denial of the Motion to Dismiss as to all claims (Counts I–IV), concluding that Plaintiffs stated plausible claims for negligence, negligence per se, ODTPA violation, and declaratory/injunctive relief; choice‑of‑law and other defenses are more appropriate for later proceedings.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Applicability of economic‑loss doctrine / choice of law | Economic‑loss should not bar tort claims because data theft caused property damage (computer data) and Ohio law should apply globally | Economic‑loss bars negligence claims for FIs in various states; apply each FI’s home state law | Court declined to decide choice of law now; found data‑as‑property theory plausible, so economic‑loss likely inapplicable at pleading stage |
| Existence of common law duty to safeguard/notify (Negligence, Count I) | Wendy’s owed duty to use reasonable care to secure payment data and to timely notify affected institutions | No common law duty exists for a merchant to safeguard card data or to notify financial institutions of a breach | At pleading stage, allegations of inadequate security and failures to follow standards stated a plausible negligence claim; denial recommended |
| Negligence per se based on FTC Section 5 (Count II) | Section 5 and analogous state statutes provide a standard of conduct and protect financial institutions harmed by unfair practices | Section 5 cannot support negligence per se; it is not a clear, concrete private‑law standard and may not protect FIs | Citing precedent recognizing Section 5 as sufficient at pleading stage, the court found Plaintiffs’ claim plausible and recommended denial of dismissal |
| ODTPA claim (Count III) | Wendy’s misrepresented security of its POS systems; FIs relied and were harmed by resulting breach | No causal link or reliance alleged; Plaintiffs fail to connect misrepresentations to FI injuries | Court held Plaintiffs alleged sufficient facts to state a plausible ODTPA claim and recommended denial of dismissal |
| Declaratory and injunctive relief (Count IV) | Plaintiffs seek declaration of duties and injunctive relief to compel specified security measures; harms ongoing and future | Claims seek past liability; associational plaintiffs lack standing; equitable relief inappropriate where legal remedies exist | Court found allegations alleged ongoing harm, associational standing plausible for declaratory/injunctive relief, and injunctive relief not foreclosed at pleading stage; recommended denial |
Key Cases Cited
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (pleading must state a plausible claim for relief)
- Phillips v. County of Allegheny, 515 F.3d 224 (pleading standards and inference drawing at motion to dismiss)
- Fowler v. UPMC Shadyside, 578 F.3d 203 (plausibility standard and reasonable expectation discovery will reveal necessary elements)
- Oshiver v. Levin, Fishbein, Sedran & Berman, 38 F.3d 1380 (matters of public record and exhibits considered on Rule 12 review)
- Giles v. GMAC, 494 F.3d 865 (discussion of economic loss doctrine in tort/contract context)
- Lexmark Int'l, Inc. v. Static Control Components, Inc., 134 S. Ct. 1377 (proximate cause/standing analysis influencing ODTPA/Lanham Act analogies)
- Hospital Council of W. Pa. v. Pittsburgh, 949 F.2d 83 (associational standing for declaratory/injunctive relief)
- Brightwell v. Lehman, 637 F.3d 187 (procedural note on waiver of appeal by failure to timely object to magistrate recommendation)