295 F. Supp. 3d 1140
W.D. Wash.2017Background
- Eddie Bauer experienced a January 2016 POS malware/data breach affecting stores in the U.S. and Canada; card data was stolen and used in fraud.
- Plaintiff Veridian Credit Union (Iowa-chartered) issued cards compromised in the breach and sued on behalf of similarly situated financial institutions nationwide, asserting negligence, negligence per se, statutory claims (RCW 19.255.020 and Washington CPA), and declaratory/injunctive relief.
- Eddie Bauer moved to dismiss; it argued Iowa law applies and raised multiple substantive challenges. The court applied Washington choice-of-law rules and concluded Washington law governs.
- The court dismissed negligence per se as not recognized in Washington (with prejudice) and dismissed declaratory/injunctive relief as standalone causes (without prejudice to seeking those remedies), but allowed other claims to proceed.
- The court held RCW 19.255.020 defines the minimum standard of care for merchants/processors under Washington law and denied dismissal of Veridian’s negligence, RCW 19.255.020, and CPA claims.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Choice of law | Washington law applies because Eddie Bauer is headquartered there and the wrongful conduct emanated from WA | Iowa law should apply (Veridian is an Iowa credit union; Iowa contacts) | Washington law applies under Wash. conflicts rules; conduct occurred in WA and WA has the most significant relationship |
| Negligence per se claim | Statutory violations support a negligence-per-se cause of action | Washington treats statutory violation as evidence, not a standalone cause | Dismissed with prejudice — negligence per se not a separate cause under WA law |
| Declaratory/injunctive relief pleaded as independent claims | Veridian may plead declaratory/injunctive relief under the Declaratory Judgment Act | Eddie Bauer: these are not independent causes; no imminent risk | Dismissed as standalone causes (remedies may be sought on viable substantive claims); leave to amend remedies only |
| Common-law duty in negligence | Eddie Bauer owed a duty to card issuers/financial institutions based on foreseeability and reliance | No special relationship; merchant owes no duty for third-party criminal acts absent misfeasance or special relationship | No duty based on common-law omission; allegations are largely nonfeasance and fail to show special relationship or affirmative misfeasance |
| Statutory duty basis: FTC Act and RCW 19.255.020 | Statutes (including FTC Act) establish duties and support negligence claim | FTC Act not intended to protect card issuers; RCW 19.255.020 is limited | FTC Act cannot impose a private statutory-duty standard here; RCW 19.255.020 satisfies Restatement §286 and defines the minimum standard of care for WA claims |
| Sufficiency of RCW 19.255.020 and CPA claims | Veridian plausibly alleges reissuance costs and injury to financial institutions and unfair practices | Eddie Bauer: allegations insufficiently plead reissuance to WA residents; insufficient unfair/deceptive act | Court finds allegations adequate to infer reissuance to WA residents for class pleading; CPA claim survives — inadequate security plausibly an "unfair act" under WA law |
Key Cases Cited
- Ashcroft v. Iqbal, 556 U.S. 662 (pleading standard: plausible allegations required)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (plausibility and Twombly/Iqbal pleading framework)
- Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487 (federal court applies forum state choice-of-law rules)
- Affiliated FM Ins. Co. v. LTK Consulting Servs., Inc., 243 P.3d 521 (Wash. 2010) (independent duty doctrine discussion replacing economic loss rule)
- Robb v. City of Seattle, 295 P.3d 212 (Wash. 2013) (duty analysis re: third-party criminal acts; misfeasance vs nonfeasance)
- Panag v. Farmers Ins. Co. of Wash., 204 P.3d 885 (Wash. 2009) (elements and construction of Washington CPA)