In re Heartland Payment Systems, Inc.
834 F. Supp. 2d 566
S.D. Tex.2011Background
- In Jan. 2009 Heartland publicly disclosed a data breach exposing payment-card data for over 100 million consumers, prompting nationwide suits consolidated MDL before the court.
- The Financial Institution Plaintiffs (nine issuer banks) allege breach of contract and implied contract, negligence and negligence per se, misrepresentation, and multiple state consumer-protection claims; the Consumer Plaintiffs are separate but not in focus here.
- Heartland moved to dismiss; after dismissing some claims against contracted banks, the court issued partial dismissal with and without prejudice and some leave to amend.
- Heartland’s contracts with Heartland Bank and KeyBank and with merchants were invoked to argue third-party-beneficiary status for FI Plaintiffs, and that network regulations (Visa/MasterCard) govern data-security duties.
- The court analyzes contract-based duties under Missouri law for the Heartland-Heartland Bank contract and finds no express third-party-beneficiary intent; it also addresses the KeyBank contract, merchant-processing agreements, and various state-law claims; overall dismissal decisions hinge on contract- and network-regime governance versus tort/privilege theories.
- amendment is permitted on limited claims (breach of contract/implied contract, certain misrepresentation theories, and select-state law claims) if FI Plaintiffs can plead viable theories under the governing constraints.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether FI Plaintiffs may plead third-party-beneficiary breach of contract claim | FI Plaintiffs contend contracts with banks/merchants created duties to safeguard data | Heartland argues no express third-party-beneficiary intent; damages limited by contract; reliance/pleading deficiencies | The contracts show no express intent to benefit FI Plaintiffs; dismissal with prejudice as to Heartland Bank contract; leave to amend for potential other contracts |
| Whether negligence claims are barred by the economic-loss doctrine | FI Plaintiffs allege duty to safeguard data and prevent losses | Texas/New Jersey law apply; economic-loss doctrine bars purely economic losses absent physical harm | Under New Jersey law, no duty to protect data to FI Plaintiffs; negligence claims dismissed with prejudice and no amendment would be futile |
| Whether misrepresentation claims meet Rule 8 and state-aid standards | FI Plaintiffs allege material misrepresentations and omissions by Heartland | Many statements are puffery or not directed to FI Plaintiffs; reliance not pled with specificity | Misrepresentation claims dismissed for failure to plead with specificity and plausible reliance; leave to amend for certain verifiable statements |
| Whether NJCFA claims by FI Plaintiffs are cognizable as business entities | Claims under NJCFA by FI Plaintiffs as consumers of processing services | FI Plaintiffs are sophisticated businesses, not consumers; NJCFA limited to consumer-oriented transactions | NJCFA claim dismissed with prejudice as to FI Plaintiffs; leave to amend to plead a consumer-like transaction or different theory |
| Whether FDUTPA/N.Y. Gen. Bus. Law § 349 claims are viable for FI Plaintiffs | Claims under FDUTPA/§349; FI Plaintiffs asserted consumer-oriented deception | FI Plaintiffs are not consumers and conduct not consumer-oriented; NY §349 limits to consumer-oriented acts | FDUTPA claim allowed to proceed; NY §349 claim dismissed with prejudice; leave to amend others as applicable |
Key Cases Cited
- People Express Airlines, Inc. v. Consolidated Rail Corp., 100 N.J. 246, 495 A.2d 107 (N.J. 1985) (economic losses may be recoverable under appropriate duty analysis; foreseen damages limited by policy; duty formation varies by context)
- Spring Motors Distributors, Inc. v. Ford Motor Co., 98 N.J. 555, 489 A.2d 660 (N.J. 1985) (allocation of contract risk preferred over tort-creating duties among sophisticated parties)
- Verni v. Cleveland Chiropractic Coll., 212 S.W.3d 150 (Mo. 2007) (limited focus on contract-language to determine third-party-beneficiary status)
- Nitro Distrib., Inc. v. Dunn, 194 S.W.3d 339 (Mo. 2006) (contract language controls third-party-beneficiary status; express intent required)
- Cumis Ins. Soc’y, Inc. v. BJ’s Wholesale Club, 455 Mass. 458, 918 N.E.2d 36 (Mass. 2009) (rejects implied misrepresentation under Visa/MasterCard regulations when no direct reliance or intent shown)
- Hannaford Bros. Co. Customer Data Sec. Breach Litig., 613 F. Supp. 2d 108 (D. Me. 2009) (negligence/contract claims in data-breach context; later affirmed in First Circuit)