IN RE: TJX COMPANIES RETAIL SECURITY BREACH LITIGATION.
Nos. 07-2828, 08-1075, 08-1076
United States Court of Appeals For the First Circuit
March 30, 2009
Boudin, Lipez and Howard, Circuit Judges.
AMERIFIRST BANK and SELCO COMMUNITY CREDIT UNION, Plaintiffs, Appellees/Cross-Appellants, v. TJX COMPANIES, INC., FIFTH THIRD BANK and FIFTH THIRD BANCORP, Defendants, Appellants/Cross-Appellees. APPEALS FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS [Hon. William G. Young, U.S. District Judge]
W. Breck Weigel with whom Robert N. Webner, Vorys, Sater, Seymour and Pease LLP, James R. Carroll, Nicholas I. Leitzes and Skadden, Arps, Slate, Meagher & Flom LLP were on brief for Fifth Third Bank and Fifth Third Bancorp.
Joe R. Whatley, Jr. with whom Patrick J. Sheehan, Whatley Drake & Kallas, LLC, Archie C. Lamb, Jr., F. Inge Johnstone and The Lamb Firm, LLC were on brief for AmeriFirst Bank and SELCO Community Credit Union.
In January 2007, TJX Companies, Inc. (“TJX“), headquartered in Massachusetts and a major operator of discount stores, revealed that its computer systems had been hacked. Credit or debit card data for millions of its customers had been stolen. Harm resulted not only to customers but, it appears, also to banks that had issued the cards (“issuing banks“), which were forced to reimburse customers for fraudulent use of the cards and incurred other expenses.
In May 2007, AmeriFirst Bank, based in Alabama, filed suit in the federal district court in Massachusetts against TJX and, in addition, against an Ohio bank and its parent--Fifth Third Bank and Fifth Third Bancorp (collectively “Fifth Third“).1 Fifth
AmeriFirst‘s complaint, seeking class action status for issuing banks, charged that both TJX and Fifth Third were variously at fault: that TJX and Fifth Third failed to follow security protocols prescribed by Visa and MasterCard to safeguard personal and financial information; that the breaches occurred from July 2005 onward but were discovered and disclosed only later; and that the issuing banks suffered losses from reimbursing customers for fraud losses, monitoring customers accounts, and cancelling and reissuing cards.
The multi-count complaint charged (1) negligence, (2) breach of contract, (3) negligent misrepresentation, and (4) unfair or deceptive practices under chapter 93A,
On December 18, 2007, the court denied the motion to amend the complaint, it made the denial of class status final, and it ordered the transfer of the case to the Massachusetts Superior Court. Although all but two of the claims had been dismissed, the district court designated its pre-transfer rulings as “without prejudice” to reconsideration by the state court. At defendants’ request, this court stayed the transfer pending review on appeal.
TJX and Fifth Third now appeal to this court, urging principally that all claims against them should have been dismissed with prejudice and that in any event transfer to the state court was precluded by governing precedent. AmeriFirst and SELCO raise standing and finality objections to defendants’ appeal and ask for affirmance of the transfer order; but by cross appeal, they say that dismissal of their other claims was error and that both class action status and the motion to amend should have been allowed.
Although no party has questioned it, we are compelled to consider first an oddity that might seem to imperil subject matter jurisdiction. Jurisdiction in the district court rested on the minimum diversity provision available only for class actions,
The answer is the district judge had provisional jurisdiction to decide those merits issues--because whether class action status was sustainable depended in part on what claims were on the table. “In such cases it is both proper and necessary for the trial court first to resolve the merits of the claim to the extent necessary to allow the court to properly determine its own jurisdiction.” Augustine v. United States, 704 F.2d 1074, 1079 (9th Cir. 1983). See generally Bell v. Hood, 327 U.S. 678 (1946).
In the end, after disposing of standing and finality objections, our analysis of the claims--both those sustained and those dismissed--leads us to agree for the most part with the able district judge‘s analysis (although not with the transfer order) but to disagree in one respect that reopens the class action issue. We therefore end by remanding for further proceedings as explained below.
Because the district court ruled that the two counts stated viable claims, the defendants were plainly and concretely disadvantaged: instead of an end to the liability claims, they now face further litigation of these claims (indeed, in this very case, because the transfer turns out to be invalid and the claims may still end up going forward in the district court). They are thus entitled to appeal from the adverse ruling--assuming that the ruling is embodied in a final judgment.
Ordinarily a defendant may not appeal from a denial of a Rule 12(b)(6) motion because the litigation in the trial court will not have concluded. But here the district court brought the case before it to an end by the class action ruling and purported transfer. Appeals from transfers between federal courts are sometimes immediately appealable and sometimes not; but where the transfer court lacks power to transfer, an order purporting to do so can hardly defeat review of an otherwise final judgment.
Finally plaintiffs invoke Balcom v. Lynn Ladder & Scaffolding Co., 806 F.2d 1127 (1st Cir. 1986), which refused to allow a third-party defendant, vindicated by a jury, to appeal from a judgment in its favor. This defendant wanted to challenge jury findings, fearing that they would prejudice it in future litigation. This court said that the findings were not essential to the judgment and thus would have no collateral estoppel effect. Id. at 1127. Balcom is clearly not on point.
Negligent misrepresentation.
We therefore turn to the merits of defendants’ appeal, starting with the negligent misrepresentation claim which the district court found adequately alleged for purposes of Rule 12(b)(6). Review of Rule 12(b)(6) rulings is de novo. First Medical Health Plan, Inc. v. Vega-Ramos, 479 F.3d 46, 51 (1st Cir. 2007). At the outset, one has to understand the nature of the claim as stated in the complaint and
The complaint alleged that Fifth Third has contracts with MasterCard and Visa that require compliance with operating regulations adopted by each credit card organization and that TJX and Fifth Third similarly have a contract that requires TJX to comply with such regulations. It further alleged that TJX and Fifth Third ignored security measures required by the operating regulations--for examples, that signatories deploy a firewall configuration, protect stored data, encrypt transmission of cardholder data, and track access to cardholder data and network resources.
But although TJX and Fifth Third are charged in the complaint with misrepresentations, the plaintiffs’ claim--as elaborated their district court filings and brief on appeal--appears to rest (with one doubtful exception as to Fifth Third2) on a flimsier foundation than actual misrepresentation. Rather, plaintiffs argue that by accepting credit cards and processing payment authorizations, defendants impliedly represented that they
Massachusetts law defines negligent misrepresentation using the Restatement (Second) of Torts (1977), which in section 552 requires the following elements:
One who, in the course of his business, profession or employment, or in any other transaction in which he has a pecuniary interest, supplies false information for the guidance of others in their business transactions, is subject to liability for pecuniary loss caused to them by their justifiable reliance upon the information, if he fails to exercise reasonable care or competence in obtaining or communicating the information.
Nycal Corp. v. KPMG Peat Marwick LLP, 426 Mass. 491, 495-96 (1998) (quoting the Restatement).
It would almost surely stretch Massachusetts law too far to say that merely doing credit card transactions with issuing banks, whether directly (Fifth Third) or indirectly (TJX), is a representation implied by conduct to third parties that the defendants were complying with detailed security specifications of Visa and MasterCard. The implication is implausible and converts the cause of action into liability for negligence--without the limitations otherwise applicable to negligence claims.
Conduct can be part of a representation, but the link between the conduct and the implication is typically tight. Thus, in Danca v. Taunton Sav. Bank, 385 Mass. 1, 9 (1982), the court
We emphasized the importance to our decision of the defendant‘s “conduct and words” and “response to the plaintiffs’ inquiry,” holding it sufficient “that the representation was reasonably understood as a statement that the bank employees had looked at the plan and found no problems.”
Page v. Frazier, 388 Mass. 55, 66-67 (1983) (quoting Danca, 385 Mass. at 9).
Yet we stop short of holding that the district court had to dismiss the misrepresentation claim in this case on the face of a complaint that explicitly alleged misrepresentation. Recently the Massachusetts trial court refused to dismiss virtually the same claim brought by credit unions against Fifth Third and another defendant for credit card losses resulting from a security breach. CUMIS Ins. Soc., Inc. v. BJ‘s Wholesale Club, Inc., 23 Mass. L. Rep. 550 (Mass. Super. 2005). Plaintiffs naturally rely on this decision, as did the district court.
Then, on summary judgment in CUMIS, it became crystal clear that the charge of “misrepresentation” rested simply on the doing of credit card business--the same implication from conduct argument that plaintiffs offer in this case. The CUMIS court then
Ordinarily a district court does not have to look behind the complaint and grant a motion to dismiss because later statements by the plaintiff offer a narrower picture of what plaintiff expects to prove at trial. Had the second CUMIS decision been available, the district court might well have granted the motion, but summary judgment is the more common method of disposing of claims that are facially valid but prove (usually after discovery) to be unsupported by evidence. The present claim thus survives, but on life support.
Chapter 93A.
The provisions of chapter 93A invoked by plaintiffs,
- negligent misrepresentation (already alleged as a separate tort) under Massachusetts law,
violation of section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45(a)(1) (2006) , which chapter 93A cross-references,3 and- violation of a federal statute that protects information that customers confide to financial institutions, Gramm-Leach-Bliley Act,
15 U.S.C. § 6801 (2006) .
The district court sustained only the first of these theories and it rejected the other two.
The negligent misrepresentation claim is likely to have no future in this case for reasons just explained and, if it falls, so too does its use under chapter 93A. Townsends, Inc. v. Beaupre, 47 Mass. App. Ct. 747, 755 (1999). Further, the district court found--and we below uphold its ruling--that the negligent misrepresentation claim, whether standing alone or under chapter 93A, is not certifiable under the class action rubric. This brings us to the second theory (plaintiffs have abandoned the third).
Plaintiffs contend that their second theory--that defendants’ lack of security measures was “unfair” under the Federal Trade Commission Act--provides an alternative basis for its chapter 93A claim. The district court disagreed, saying that the unfairness characterization rested on consent decrees of the Federal Trade
However Whitinsville may be read, plaintiffs’ claim here rests on far more than consent decrees, which sometimes do go beyond legal obligations. Specifically, they invoke (1) an FTC complaint against TJX based on the very security lapse charged here and (2) at least two other cases in which the FTC ruled that similar conduct violated the Federal Trade Commission Act.4 The FTC complaint against TJX states (in paragraph 12):
[R]espondent‘s failure to employ reasonable and appropriate security measures to protect personal information caused or is likely to cause substantial injury to consumers that is not offset by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers. This practice was and is an unfair act or practice.
Use of FTC precedent--certainly as to decided cases like DSW and BJ‘s--is directly supported by chapter 93A itself. Further, Massachusetts case law treats FTC complaints as an expression of the
The first--that chapter 93A requires a closer association than its indirect connection with AmeriFirst--was answered by the district court. Case law does require a business relationship, e.g., Imprimis Investors, LLC v. KPMG Peat Marwick LLP, 69 Mass. App. Ct. 218, 230-31 (2007), but here a jury might say that TJX was regularly seeking payment from the issuing banks through an intermediary (Fifth Third) and that this is a close enough connection. At least at the complaint stage, this seems enough.
TJX next argues correctly that chapter 93A is intended exclusively for egregious conduct, see Ahern v. Scholz, 85 F.3d 774, 797-98 (1st Cir. 1996), and--it contends--that either deliberate wrongdoing or personal benefit is present in virtually all of the sound case law. Perhaps policy might make this a desirable stopping point, given the vagueness of the unfairness standard and availability of a private damages remedy unchecked by agency prudence.
But Massachusetts decisions do not say that deliberate wrongdoing or self-benefit are required; seemingly systematic
Finally, Fifth Third argues that the chapter 93A claim must fail against it because none of its acts occurred “primarily” or “substantially” within Massachusetts. See
One final point as to the unfairness-based claim under chapter 93A. The district court indicated, in its decision on October 12, 2007, that federal subject matter jurisdiction might independently attach to such a claim--regardless of class action status--because a federal issue might be deemed embedded in the
The embedded issue theory, associated with Smith v. Kansas City, 255 U.S. 180 (1921), raises a complicated and much mooted problem as to the proper construction of the “federal question” statute.
But if the Smith theory becomes critical, jurisdiction should not be assumed merely because the state claim resorts to federal precedent; nor is it perfectly clear that Massachusetts regards the section 5 standard as binding (as opposed to merely informative precedent to be considered)--which would arguably not suffice even under Smith. It is enough to warn that there is precedent and commentary that would have to be consulted and briefed if and when necessary.6
Plaintiffs say that the district court erred in dismissing their simple negligence claim, a ruling that it based upon the so called economic loss doctrine. Massachusetts, which is not alone, holds that “purely economic losses are unrecoverable in tort and strict liability actions in the absence of personal injury or property damage.” Aldrich v. ADD Inc., 437 Mass. 213, 222 (2002). Like “duty” and “proximate cause,” the doctrine cabins what could otherwise be open-ended negligence liability to anyone affected by a negligent act.
AmeriFirst says that it did suffer property damage because it had a property interest in the payment card information, which the security breach rendered worthless. Electronic data can have value and the value can be lost, but the loss here is not a result of physical destruction of property. Indeed, a reduction in real property value, by dumping of contaminants in the neighborhood but not on plaintiff‘s property was held to be economic loss. Lewis v. General Electric, 37 F. Supp. 2d 55 (D. Mass. 1999).
Plaintiffs offer policy arguments for limiting the economic loss doctrine, but the physical injury requirement reflects existing precedent, Lewis; Am. Tel. & Tel. Co. v. IMR Capital Corp., 888 F. Supp. 221, 247 (D. Mass. 1995). CUMIS itself invoked the economic loss doctrine to bar a negligence claim on the same facts. 23 Mass. L. Rptr. 550, at *8-9. Accord, Pa. State Employees Credit Union v. Fifth Third Bank, 398 F. Supp. 2d 317, 326 (M.D. Pa.
Breach of contract.
Plaintiffs also do not persuade us that the district court erred in dismissing their contract claims. Here, Visa and Mastercard bound participating banks like Fifth Third to certain security procedures and approving banks like Fifth Third bound sellers like TJX for whom they processed payments; but the issuing banks were not parties to either of these contracts and can therefore bring claims only if they were third-party beneficiaries.
Massachusetts law follows the third-party beneficiary test of the Restatement (Second) of Contracts § 302 (1981), see Rae v. Air-Speed, Inc., 386 Mass. 187, 195 (1982), which is relatively hospitable to claims by those purporting to be third-party beneficiaries--except where the direct parties to the contract have “otherwise agreed.” Section 302(1) states:
Unless otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intention of the parties and . . . the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance.
The parties to the contracts in this case appear to have “otherwise agreed.” The agreement between Fifth Third and TJX provides: “This Agreement is for the benefit of, and may be enforced only by, Bank and Merchant . . . and is not for the benefit of, and
Instead, the MasterCard Operating Regulations state that MasterCard “shall have the sole right to interpret and enforce” its regulations, and the Visa Operating Regulations say that they “do not constitute a third-party beneficiary contract as to any entity or person . . . or confer any rights, privileges, or claims of any kind as to any third parties.” CUMIS is in accord. 23 Mass. L. Rptr. 550, at *5-6. See also Pa. State Employees Credit Union, 398 F. Supp. 2d at 323-26.
Conversion.
Plaintiffs did not plead a claim for conversion in their original or amended complaint but sought to add it on October 25, 2007, a month after submitting the amended complaint. The district court denied the motion on the ground that the claim was not viable, saying that conversion related only to interference with tangible property, and that plaintiffs claim concerned intangible property. We review this denial for abuse of discretion. Aponte-Torres v. Univ. of P.R., 445 F.3d 50, 58 (1st Cir. 2006).
In all events, the claim is not straightforward, could have been presented in the original complaint, and does not depend on newly discovered facts. The district court‘s decision not to entertain a belated claim on top of numerous ones already pled and under consideration, was not an abuse of discretion. Nor did the court have to allow belated amendment of the chapter 93A claim to add facts that could have been asserted earlier.
Class certification.
After determining which claims survived, the district court then applied the customary tests to decide whether class action status could be sustained for the case, see
Plaintiffs expressly decline to appeal from the denial of class certification of the two claims in question--the negligent representation claim and the chapter 93A claim resting on the same theory. But arguing that some of the district court‘s discussion is mistaken, or overcome by proffered amendments to the class definition, they express concern that some of the discussion might imperil certification on remand of any other claim that we might reinstate on appeal--which is just what we are doing.
Conversely, TJX (although for intricate reasons not Fifth Third) appears to agree that the district court‘s denial of certification is mooted by plaintiffs’ failure to appeal it; but defendants themselves urge that--should we reinstate any of the dismissed claims--we “affirm” the denial of certification and “conclude that it precluded class certification of any revived claims(s).” In other words, both sides suggest that we resolve, although in opposite ways, a question not reached by the district court.
The district court‘s resolution of the certification issue before it--not to certify the negligent misrepresentation claim--turned primarily on its conclusion that that claim required proof of individual reliance on the misrepresentation--directly so for the tort claim and at least indirectly so for the chapter 93A
It is not clear to us whether a chapter 93A claim based on an unfairness theory would necessarily raise the same problem or be barred on the same basis. The unfairness theory appears to look to what the defendants did (or failed to do) rather than on the banks’ reliance on supposed misrepresentations; but the district court‘s discussion of proof of causation of loss as a separate individual-party issue may (or may not) apply to unfairness claims as well. Neither side has briefed this issue and obviously the district court has not decided it.
The district court also expressed concern about whether the putative class was properly defined by plaintiffs and about whether plaintiffs could provide fair and adequate representation, also a precondition for class status.
The district court showed an enviable mastery of class action law and analysis, and the wisest course is to let it decide in the first instance whether the chapter 93A unfairness theory merits class status. To pick apart an integrated analysis and
Transfer.
Having denied certification, the district court concluded that the case could not proceed in federal court, partly because too little was at stake for the individual plaintiffs but primarily because ordinary diversity is lacking once the minimal diversity provided for a qualified class action fails. Defendants attack, and plaintiffs defend, the transfer order--authority to transfer being “a legal question we review de novo.” Mills v. Maine, 118 F.3d 37, 51 (1st Cir. 1997) (citation omitted).
Mills squarely decided “that, in the absence of any specialized state statute, ‘it is the duty of the trial court, if it finds that jurisdiction does not exist, to proceed no further but to dismiss the suit.‘” Id. at 52 (emphasis in original) (quoting Joy v. Hague, 175 F.2d 395, 396 (1st Cir. 1949)). Most of Mills’ reasoning would apply even if there were a Massachusetts statute authorizing such a transfer, compare Weaver v. Marine Bank, 683 F.2d 744 (3rd Cir. 1982); anyway, no such statute is invoked.
Mills’ ruling on transfers to state courts was not, as has been suggested, merely dictum. In Mills, the district court had refused to transfer to state court a suit that fell outside its own subject matter jurisdiction and on appeal appellants insisted that
In ordering transfer, the district court said that its prior merits rulings were “‘without prejudice’ to reexamination in the courts of the Commonwealth.” TJX says that this too was error. The “without prejudice” label has different meanings in different contexts, e.g., In re Sonus Networks, Inc., 499 F.3d 47, 60 n.6 (1st Cir. 2007); perhaps the district judge meant only that a transferee court can revisit its prior rulings in the same case. Rio Mar Assocs., LP v. UHS of P.R., Inc., 522 F.3d 159, 167 (1st Cir. 2008).
It would quite another matter to decide a merits issue but then purport to deprive the decision of res judicata effect in future cases--a matter governed by established rules. E.g., Ramallo Bros. Printing, Inc. v. El Dia, Inc., 490 F.3d 86 (1st Cir. 2007). But the “without prejudice” gloss here was commentary incident to the transfer order and, as we are vacating that order and remanding the case, we treat the characterization as falling with the order.
Accordingly, we affirm (1) the district court‘s dismissal of the negligence and breach of contract claims, (2) its denial of the motion to amend the complaint, and (3) its sustaining of the negligent misrepresentation claim (and use as a theory under chapter
It is so ordered.