Opinion
No. CIV 07-374-TUC-CKJ.
September 18, 2008
ORDER
Pending before the Court are Defendants' Motions to Dismiss [Doc. #s 81 and 82]. Responses and Replies have been filed. The parties presented oral argument to the Court on June 5, 2008. The Court took the matters under advisement.
I. Factual and Procedural Background
Unless otherwise stated, the facts are taken from the Second Amended Complaint.
Cumis Insurance Society, Inc. ("Cumis") is an insurer that provides coverage to credit unions. As a result of a data security breach involving, among others, Merrick Bank Corporation ("Merrick"), Merrick's agent CardSystems Solutions, Inc. ("CardSystems"), Savvis, Inc. ("Savvis"), and Savvis Communications Corporation, Cumis has paid millions of dollars in indemnity payments to its credit union insureds for credit and debit card fraud losses suffered by individual members.
The security breach was the result of CardSystems' failure to protect the data and CardSystems' wrongful retention of magnetic-stripe credit and debit card data and account information on its computer servers. Merrick guaranteed CardSystems' compliance with industry rules and regulations, assumed responsibility for CardSystems' non-compliance with industry rules and regulations, and agreed to indemnify third parties for the fraud losses that foreseeably followed.
An investigation confirmed that hackers had stolen magnetic-stripe data from CardSystems' computer systems. The multiple incidents of theft went undetected over a period of at least several months and approximately 40 million consumer card account numbers were exposes to computer hackers.
Savvis had been retained specifically to certify that CardSystems' computer systems were in compliance with industry security rules and regulations and issued one or more certificates of compliance that certified that CardSystems' computer systems were secure and that CardSystems did not retain magnetic-stripe data. However, CardSystems' computer systems had been storing magnetic-stripe data for several years and continued to store this data during the relevant time periods in which Savvis inspected CardSystems' computer systems.
A complaint was filed in the California state court. The matter was removed to the United States District Court, Central District of California, on June 4, 2007, and was transferred to the District of Arizona on June 24, 2007.
This Court previously granted a motion to dismiss with leave to amend. Specifically, the court dismissed the California Business and Professions Code ("BPC") Section 17200 claim with leave to amend and directed Cumis to allege sufficient facts to support a claim that Savvis has in its possession funds that Cumis has an interest in. Additionally, the Court dismissed without leave to amend Cumis' Civ. Cod § 1798.80 claim and Cumis' BPC claim for actual damages.
On February 11, 2008, Cumis filed a Second Amended Complaint in which it alleged claims for Negligent Interference with Prospective Economic Advantage, Unfair, Deceptive and Unlawful Business Practices in Violation of BPC §§ 17200 et seq., Breach of Contract, Misrepresentation against Merrick, Misrepresentation against Savvis, Negligence, and Conversion/Trespass to Chattel.
On March 17, 2008, Savvis and Merrick each filed a Motion to Dismiss. Cumis has filed responses and replies have been filed.
II. Motion to Dismiss
The United States Supreme Court has found that, in order to survive a motion to dismiss for failure to state a claim, a plaintiff must allege "enough facts to state a claim to relief that is plausible on its facts." Bell Atlantic Corp. v. Twombly, ___ U.S. ___, 127 S.Ct. 1955, 1974, ___ L.Ed.2d ___ (2007). While a complaint need not plead "detailed factual allegations," the factual allegations it does include "must be enough to raise a right to relief above the speculative level." Id. at 1964-65. Indeed, Fed.R.Civ.P. 8(a)(2) requires a showing that a plaintiff is entitled to relief "rather than a blanket assertion" of entitlement to relief. Id. at 1965 n. 3. The complaint "must contain something more . . . than . . . a statement of facts that merely creates a suspicion [of] a legally cognizable right to action." Id. at 1965. Thus, a motion to dismiss pursuant to Fed.R.Civ.P. 12(b)(6) (or a motion for judgment on the pleadings) should be granted when a plaintiff fails to "nudge [his] claims across the line from conceivable to plausible." Id. at 1974. However, the Supreme Court has cited Twombly for the traditional proposition that "[s]pecific facts are not necessary [for a pleading that satisfies Rule 8(a)(2)]; the statement need only 'give the defendant fair notice of what the . . . claim is and the grounds upon which it rests." Erickson v. Pardue, ___ U.S. ___, 127 S.Ct. 2197, 2200, 167 L.Ed.2d 929 (2007). Twombly involved a § 1 Sherman Act complaint and the Supreme Court did not discuss how this standard applies to other actions. However, the Ninth Circuit Court of Appeals cited to Twombly in determining whether dismissal of employment discrimination and civil rights claims was appropriate. See Johnson v. Riverside Healthcare System, LP, 534 F.3d 1116 (9th Cir. 2008).
The holding in Twombly explicitly abrogates the well established holding in Conley v. Gibson, 355 U.S. 41, 45-46, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957), that "a complaint should not be dismissed for failure to state a claim unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief."
This Court must take as true all allegations of material fact and construe them in the light most favorable to the nonmoving party. See Cervantes v. United States, 330 F.3d 1186, 1187 (9th Cir. 2003). In general, a complaint is construed favorably to the pleader. See Scheuer v. Rhodes, 416 U.S. 232, 236, 94 S.Ct. 1683, 40 L.Ed.2d 90 (1974), overruled on other grounds, 457 U.S. 800. Nonetheless, the Court does not accept as true unreasonable inferences or conclusory legal allegations cast in the form of factual allegations. Western Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981).
III. Savvis' Motion to Dismiss
Savvis asserts that the BPC does not permit recovery of non-restitutionary disgorgement and that to have standing to bring a claim under the BPC, the statute requires that Cumis allege a loss of money or property, which requires the same showing as needed to establish a right to restitution. Savvis also asserts that the Conversion/Trespass to Chattel claim should be dismissed because the magnetic stripe data allegedly converted is purely intangible property that, on its own, cannot be converted or trespassed. Further, Savvis asserts that Cumis has not, and cannot, allege the required elements that Savvis ever came into possession of, and exercised dominion and control over, Cumis' property, or that Savvis in any way impaired Cumis' property.
IV. Merrick's Motion to Dismiss
Merrick asserts that Cumis' claim for Negligent Interference with Prospective Economic Advantage is not recognized under Arizona law. Merrick also asserts that the BPC must be dismissed because that statute has no application to Merrick, which committed no acts in California, to Cumis, which is not a California resident, or to the events at issue because they did not take place in California. Merrick asserts that, because there is no contract with Cumis and Cumis cannot claim to be a third party beneficiary, no claim for breach of contract has been alleged. Merrick also asserts that Cumis has failed to plead its claim for misrepresentation with particularity as required by Fed.R.Civ.P. 9, such a claim is barred by the economic loss rule, and Cumis had no right to rely on the allegedly inaccurate representations. Merrick asserts that the claim for negligence is barred by the economic loss rule and because Arizona does not recognize a claim as alleged. Merrick also asserts that Arizona does not recognize a claim for conversion/trespass to chattel based on the misuse of electronically stored date and, further, such a claim is barred by the economic loss rule.
V. Choice of Law
The choice of law rule of the transferor venue applies in a transferred case. International Business Machines Corp. v. Bajorek, 191 F.3d 1033 (9th Cir. 1999). Generally, California applies the "governmental interest analysis" for tort claims as well as Restatement principles. Reich v. Purcell, 432 P.2d 727 (Cal. 1967); Shannon-Vail Five Inc. v. Bunch, 270 F.3d 1207, 1214 (9th Cir. 2001). This approach considers "'the interests of the litigants and involved states'" and the "situs of the allegedly wrongful act remains a relevant, and often predominant, consideration." Shannon-Vail, 270 F.3d at 1215.
Merrick cites to the District Court of California's transfer order in support of its assertion that Cumis' claims and alleged damages arise entirely from activities that occurred in Arizona:
CardSystems' security breach took place in Arizona, and CardSystems' only business operations were in Arizona. Thus the security breach that allegedly caused [Cumis'] injuries and most of the contacts relevant to this case are in Arizona . . . Moreover, because this cause of action arises from CardSystems' security breach, most of the evidence that is needed to resolve this case is located in Arizona.Cumis Ins. Society, Inc. v. Merrick Bank Corp., CV 07-3616 GPS (PJWx) (C.D.Cal. 7/24/07). Cumis asserts, however, that, unlike the consideration of a venue transfer, the consideration for a motion to dismiss may not consider extrinsic evidence. Arpin v. Santa Clara Valley Transp. Agency, 261 F.3d 912, 925 (9th Cir. 2001). Moreover, the transfer was based on the relationship to the bankruptcy proceeding, rather than on substantive factual issues in the case. Indeed, Cumis and Savvis disputed that venue was proper in Arizona because of CardSystems' substantial contacts with California and because witnesses and documents were more readily available in California.
Merrick asserts that CardSystems also had business operations in Delaware and offices in Georgia.
Merrick asserts that Arizona has a fundamental interest in regulating the conduct at issue in this case because the conduct occurred within its borders. California's only interest is that of a forum state; Merrick asserts that interest is overcome by Arizona's interest "in regulating conduct within its own borders." Reding v. Texaco, Inc., 598 F.2d 513, 518 (9th Cir. 1979); Shannon-Vail, 270 F.3d at 1215 (Nevada law applied where the tort occurred in Nevada and defendants were Nevada citizens and conducted their business in Nevada even though plaintiff was incorporated in California).
Cumis asserts, however, that no admissible evidence supports Merrick's assertion. Rather, Cumis asserts that the Second Amended Complaint does not allege that its claims arose in Arizona. The Second Amended Complaint alleges that Merrick and its agent CardSystems does/did business in California, that CardSystems entered into an audit agreement with Savvis in California, that Merrick, including through its agent CardSystems, made misrepresentations concerning CardSystems' compliance with Cardholder Information Security Program ("CISP") to California entities, and that Merrick and CardSystems caused injury to at least 136 credit unions in California. Cumis points out that it is the place of injury, rather than place of "breach" that is the predominant factor in considering choice of law for tort claims. Restatement (Second) Conflict of Laws §§ 146, 147.
Converting this motion to dismiss to a motion for summary judgment is not appropriate because substantive facts could be disclosed during discovery. Consideration of extrinsic evidence, therefore, is not appropriate. However, Merrick points out that Cumis' "artful pleading" cannot foreclose a choice of law analysis. Treadway v. Academy of Motion Picture Arts and Sciences, 783 F.2d 1418, 1421 n. 3 (9th Cir. 1986) (artful pleading cannot disguise the true nature of the claims in order to evade principles governing choice of law). Based on the allegations contained within the Second Amended Complaint, it does not appear that Arizona has a significant interest in this matter. However, it appears the security breach occurred in Arizona. Although this fact is not included within the Second Amended Complaint, it is a part of the record of this case. See, Doc. # 38, Transfer Order, p. 3. Cumis should not be able to avoid this fact in a choice of law question by simply omitting it from the Second Amended Complaint.
Moreover, although Cumis asserts that the greatest injury occurred in California, this is a conclusory allegation. Additionally, Cumis' conclusory allegation appears to be based on the fact that California's population is greater than Arizona's. In other words, although there may numerically be more injured credit unions in California, Cumis has not made any claim that, proportionate to their respective populations, California has more injured credit unions than Arizona. Moreover, there is no claim as to the extent of injuries suffered by credit unions in California as opposed to the extent of injuries suffered in Arizona. It is difficult to conclude, therefore, that California has a greater interest in the litigation. The Court finds Arizona law applies to this case.
VI. Negligent Interference with Prospective Economic Advantage
VII. Unfair, Deceptive Unlawful Business Practices in Violation of BPC §§ 17200 et seq.
Southwest Pet Products, Inc. v. Koch Industries, Inc.89 F.Supp.2d 11151131affirmed in part, reversed in part. California Nexus to Sustain a Claim under § 17200
Merrick cites to this Court's dismissal order regarding the requirement of the conduct and harm for a § 17200 claim:
Savvis asserts that the BPC § 17200 does not apply to Cumis because it is not a California resident and the alleged conduct and harm occurred outside of California's borders. Cumis asserts that it has agreed to file an amended complaint to include allegations concerning wrongful conduct that occurred in California. The motion to dismiss will be granted as to this claim; the dismissal will be with leave to amend.
1/24/08 Order, p. 4. Merrick asserts that Cumis has failed to allege that either Merrick or CardSystems did anything in California that is even remotely related to this case. Merrick asserts that Cumis' allegations that a substantial number of credit card account numbers that were compromised were issued to credit unions and members who reside in California does not set forth any conduct in California.
Merrick's Motion to Dismiss points out that Savvis sent a copy of its certification from its offices in California to VISA's offices in California.
There is a presumption that California statutes have no extraterritorial application. Churchill Village, L.L.C. v. General Elec. Co. 169 F.Supp.2d 1119, 1126-27 (N.D.Cal. 2000). Further, this presumption applies to § 17200. Churchill, 169 F.Supp.2d at 1126; Norwest Mortgage, Inc. v. Superior Court, 72 Cal.App.4th 214, 221-225, 85 Cal.Rptr.2d 18 (Cal.App. 1999). Merrick asserts that Cumis is not a California resident, the alleged unfair business practices took place in Arizona, and the presence of some of Cumis' insureds in California does not provide a sufficient nexus to state a cause of action under § 17200.
Cumis asserts that the Second Amended Complaint includes allegations that Merrick and CardSystems made specific misrepresentations concerning CardSystems' purported compliance with CISP to California entities and that the misrepresentations caused injury to at least 136 credit unions insured by Cumis in California.
The Court finds that Cumis has alleged conduct and harm occurred in California and has stated sufficient allegations to "nudge [its] claims across the line from conceivable to plausible." Twombly, 127 S.Ct. at 1974.
B. Restitutionary Disgorgement
Savvis asserts that Cumis has again failed to adequately allege that Savvis possessed or otherwise has a vested ownership interest in the funds sought as restitution for the BPC claim. Where a plaintiff fails to allege facts supporting a finding that plaintiff has an ownership interest in property or funds in the defendant's possession, dismissal is appropriate. United States v. Sequel Contractors, Inc., 402 F.Supp.2d 1142, 1156 (C.D.Cal. 2005). Indeed, nonrestitutionary profits paid to a defendant by third parties are not recoverable under the BPC. See Madrid v. Perot Systems Corp., 130 Cal.App.4th 440, 455-56 (2005).
Merrick asserts that Cumis' allegations regarding the flow of funds in a credit card transaction establish that Merrick has retained no funds in which Cumis could legitimately claim any ownership or vested interest. Indeed, Cumis alleges that funds paid by Cumis' insureds in connection with credit card charges are not retained by Merrick but, rather, are passed on to the merchants. Merrick asserts that it is only the merchants, not the credit unions, who could claim an ownership interest in the funds retained by Merrick.
Cumis asserts, however, that the Second Amended Complaint specifically alleges that its insured credit unions made payments to Merrick for credit and debit card transactions and that some monies were in fact retained by Merrick. The issue is whether Cumis has an interest in funds paid by the insured credit unions. Generally, restitution under California's unfair competitive law is limited to the return of money obtained through an unfair business practice to persons from whom the money was taken. Korea Supply, 29 Cal. 4th at 1144-49, Madrid v. Perot Systems Corp., 130 Cal.App.4th 440, 453 (2005). However, Juarez v. Arcadia Financial Ltd., 152 Cal.App.4th 889, 915 (2007), citation omitted, recognized that the BPC is not limited to the "'return of money or property that was once in the possession of that person.'" Cumis seeks return of funds that are alleged to have been wrongfully obtained from Cumis' insured credit unions. Cumis has alleged that Savvis should disgorge any and all fees that Savvis collected from CardSystems, including audit fees, because they may be traced to funds paid by Cumis' insured credit unions to Merrick and/or CardSystems. Savvis asserts in its Reply that, by limiting its argument to fees, Cumis is acknowledging that its request for restitutionary disgorgement is too broad.
The Court's Order on the prior motion to dismiss directed that the amended complaint shall "allege sufficient facts to support a claim that Savvis has in its possession funds that Cumis has an interest in." 1/24/08 Order, p. 8. Other than the fees, Cumis has not alleged any funds in Savvis' possession that Cumis has an interest in. Rather, Cumis merely alleges that Cumis may have an interest in funds received by Savvis from Merrick and/or CardSystems and funds received by Merrick and/or CardSystems from issuing credit unions and their members. The Court finds that the claim should go forward because, if Cumis can establish Savvis' profits can be traced to "ill-gotten funds," restitutionary disgorgement may be appropriate. Juarez, 152 Cal.App.4th at 915.
C. Standing to Assert Claim under the BPC
Savvis asserts that, because Cumis is not entitled to restitution from Savvis, Cumis does not have standing to assert a claim under the BPC. Under the BPC, a plaintiff who has "lost money or property as a result of such unfair competition" has standing to bring a claim. § 17204. California courts have interpreted this "loss of money or property" requirement as limiting standing "to individuals who suffer losses of money or property that are eligible for restitution" under the BPC. Buckland, 155 Cal.App.4th at 818 (plaintiff suspected deceptive practice prior to purchase or purchased product to pursue litigation; Walker v. USAA Cas. Ins. Co., 474 F.Supp.2d 1168, 1172 (E.D.Cal. 2007) (deprivation of expected profits).
Cumis asserts that, unlike Buckland and Walker, it suffered actual out-of-pocket losses and this out-of-pocket injury is alleged to have been caused by the unfair or unlawful business practices of Savvis. This case is similar to Overstock.com Inc. v. Gradient Analytics, Inc., 151 Cal.App.4th 688 (2007) (standing was found to exist where the plaintiff pled unlawful action resulted in injury to plaintiff's stock value), and Huntingdon Life Sciences, Inc. v. Stop Huntingdon Animal Cruelty USA Inc., 129 Cal.App.4th 1228 (2005) (standing found where plaintiff suffered damage to her property as the result of animal activists' conduct in violation of BPC). In neither Overstock.com nor Huntingdon Life Sciences was standing contingent upon showing that plaintiffs paid funds to defendants. The injury in fact suffered by those plaintiffs is similar to the injury suffered by Cumis.
The Court finds that, because it has found that the allegation regarding the fees to be sufficient for restitution, a claim has been stated.
VIII. Economic Loss Rule
Merrick asserts that the economic loss rule prevents Cumis from obtaining relief on its claims of negligent misrepresentation, negligence, and conversion. Purely economic damages in tort claims are limited to situations where the harm alleged is based on a clearly identifiable duty owed by a defendant to a plaintiff independent of any contract rights. Carstens v. City of Phoenix, 206 Ariz. 123, 75 P.3d 1081 (App. 2003). Stated another way, the "economic loss rule bars a party from recovering economic damages in tort unless accompanied by physical harm, either in the form of personal injury or secondary property damage." Carstens, 206 Ariz. at 126, citation omitted.
Cumis points out, however, that, in application, the economic loss rule is not broadly applied in Arizona. In Evans v. Singer, 518 F.Supp.2d 1134 (D.Ariz. 2007), the court discussed that Arizona had only applied the economic loss rule in construction and product defect cases and found that it did not apply to a negligence claim where there was a contractual relationship between a real estate agent and her client. Similarly, in this case, the contractual relationships are not similar to construction or product defect cases. Merrick asserts, however, that the economic loss rule is not dependent on the field of endeavor, but on the source of the duty owed by a defendant to a plaintiff. Merrick asserts that Cumis has failed to allege a clearly identifiable duty independent of any contract rights and, therefore, Cumis' tort claims are barred by the economic loss rule.
The Supreme Court of Arizona has stated that, "[r]ather than adopting the majority rule as a blanket disallowance of tort recovery for economic losses, we think the better rule is one which examines the loss in light of the nature of the defect that caused it, the manner in which it occurred, and the nature of any other contemporaneous losses." Salt River Project Agric. Improvement Power Dist. v. Westinghouse Elec. Corp., 143 Ariz. 368, 377, 674 P.2d 198, 209 (1984). The Court indicated that, when assessing pure economic loss, courts should first examine whether there was any accompanying loss where "the defect presented a real danger of harm to person or other property, an 'accident' did occur, the damage was of the type recognized as 'tort damage' (harm to person or other property), or if some combination of these factors preponderates." Id. at 378. Tort remedies are available if the factors are present. Id. In difficult cases, the court should consider "1) the nature of the product defect, 2) the manner in which the loss occurred, and 3) the types of loss or damage that resulted." Id.
In this case, the loss was the result of a data security breach. The alleged breach of the contract itself did not cause the loss — although the data security breach could not have occurred without the alleged breach of contract. Without the data security breach, the alleged breach of the contract itself would not have caused the losses at issue in this case. The alleged breach of contract presented a real danger of harm to persons or property because it, allegedly, permitted the data security breach. The data security breach is comparable to a tortious "accident" and the damages are of a type that caused economic harm to persons or entities. Indeed, tortious damages may include purely economic damages (e.g., fraud). The Court finds that the Salt River factors are present and, therefore, tort remedies are available in this case. Dismissal of the tort claims based on the economic loss rule is not appropriate.
IX. Conversion
To state a claim for conversion, a plaintiff must allege a plaintiff's ownership or right to possession of property, a defendant's wrongful act toward or disposition of the property, interfering with plaintiff's possession, and damages. PCO, Inc. v. Christensen, Miller, Fink, Jacobs, Glaser, Weil Shapiro, LLP, 150 Cal.App.4th 384, 395 (2007). Dismissal is appropriate where a plaintiff has failed to allege an intention of a defendant to "convert the owner's property, or to exercise some act of ownership over it[.]" Simonian v. Patterson, 27 Cal.App.4th 773, 791 (1994); Miller v. Hehlen, 209 Ariz. 462, 472, 104 P.3d 193, 203 (App. 2005), citation omitted (A conversion action requires "an intentional exercise of dominion or control over a chattel which so seriously interferes with the right of another to control it that the actor may justly be required to pay the other the full value of the chattel.").
Savvis asserts that Cumis has failed to allege that Savvis, as opposed to CardSystems, exercised dominion or control over any cardholder data such that it had the ability to interfere with its possession of such property. Cumis does not dispute Savvis' argument that exclusive dominion or control is needed for a claim of conversion. The motion to dismiss will be granted as to the conversion claim.
X. Trespass to Chattel
Noting that Arizona courts follow the Restatement (Second) of Torts absent authority to the contrary, the Court of Appeals of Arizona has stated that "the tort of trespass to a chattel may be committed by intentionally dispossessing another of the chattel or using or intermeddling with the chattel in the possession of another. Koepnick v. Sears Roebuck Co., 158 Ariz. 322, 330-31, 762 P.2d 609, 617-18 (App. 1988), citing Restatement (Second) of Torts § 217 (1965). Cumis asserts that a claim for trespass to chattel can be stated if there was interference with property, however slight, and if the interference caused actual injury to the plaintiff. Intel Corp. v. Hamidi, 30 Cal.4th 1342, 1350 (2003). Cumis' claim of trespass to chattel is based on the alleged unauthorized use and storage of magnetic stripe data.
However, Savvis asserts that Cumis has failed to allege that Savvis, as opposed to CardSystems, exercised dominion or control over any cardholder data such that it had the ability to interfere with its possession of such property. In Koepnick, the Court of Appeals further stated:
Comment b to § 221 provides that dispossession may occur when someone intentionally assumes physical control over the chattel and deals with the chattel in a way which will be destructive of the possessory interest of the other person. Comment b further provides that "on the other hand, an intermeddling with the chattel is not a dispossession unless the actor intends to exercise a dominion and control over it inconsistent with a possession in any other person other than himself."Koepnick, 158 Ariz. at 331. Cumis argues that, but for Savvis's certification, CardSystems and Merrick would not have been able to wrongfully retain magnetic stripe data. However, Cumis does not explain how "but for" conduct constitutes intentional conduct. Moreover, the Court agrees with Savvis that there is no allegation that Defendants, as opposed to CardSystems, exercised dominion or control over any cardholder data. The Court finds dismissal of the trespass to chattel claim is appropriate.
XI. Breach of Contract
A. Lack of Allegations that Cumis is an Intended Beneficiary
Merrick asserts that the Second Amended Complaint fails to allege that Cumis or its insureds are intended beneficiaries of contract. "For a person to recover as a third-party beneficiary in Arizona, the contracting parties must intend to directly benefit that person and must indicate that intention in the contract itself." Sherman v. First American Title Ins. Co., 201 Ariz. 564, 38 P.3d 1229 (App. 2002); see also, Fourth Ocean Putnam Corp. v. Interstate Wrecking Co., Inc., 66 N.Y.2d 38, 45, 495 N.Y.S.2d 1, 5, 485 N.E.2d 208, 212 (1985) (third party beneficiary status is limited to intended beneficiaries).
Merrick asserts that New York law governs Merrick's contractual relationship with MasterCard based on the choice of law provision in the contract between Merrick and MasterCard. Cumis does not dispute this.
Merrick asserts that the only contracts that could conceivably form the basis of Cumis' third party beneficiary claim are the written sponsorship agreements of CardSystems with VISA and MasterCard. However, Merrick asserts that these contracts do not evidence any intent to directly benefit Cumis or its insured. For example, the MasterCard Member-Sponsored User Agreement indemnifies only MasterCard and does not include any obligations to any other party. Similarly, the agreement with VISA includes an obligation to indemnify VISA, but there are no obligations to any other party mentioned in the agreement.
Cumis asserts, however, that the sponsorship agreements are extrinsic evidence and cannot be considered in a motion to dismiss. In re Colonial Mortgage Bankers Corp., 324 F.3d 12, 16 (1st Cir. 2003). However, a contract that is central to a plaintiff's claim is not a matter outside the pleadings. See Cullen v. Koty-Leavitt Ins. Agency, Inc., 216 Ariz. 509, 168 P.3d 917 (App. 2007); Broder v. Cablevision Sys. Corp., 418 F.3d 187, 196 (2nd Cir. 2005). The parties in this case dispute which contract is central to Cumis' claim. Cumis disputes Merrick's assertion that the sponsorship documents discussed by Merrick are the only contracts that could conceivably be at issue in this case. Rather, Cumis asserts that other sponsorship agreements are at issue in this case. Cumis further argues that the documents submitted by Merrick are only portions of a larger agreement.
Merrick also argues that Cumis' failure to identify specific contracts and provisions requires dismissal. Doyle v. Hasbro, Inc., 103 F.3d 186, 195 (1st Cir. 1996). Merrick asserts that a discussion in the response to the motion to dismiss regarding older sponsorship agreements does not rectify the fact that the Second Amended Complaint does not contain any reference to the contracts alleged to have been breached. In its Second Amended Complaint, Cumis asserts that the sponsorship agreements and other agreements stated that Merrick assumed responsibility for all losses caused by CardSystems' failure to fulfill the card processing obligations under Visa and MasterCard's rules and regulations. The Second Amended Complaint further states that, pursuant to the sponsorship agreements, other written agreements, and/or common law agency principles, Merrick agreed to "undertake full financial responsibility, irrespective of fault, for all claims, losses or costs caused by CardSystems' acts and/or omissions." Second Amended Complaint, p. 6. The Court assumes the truth of this allegation for purposes of the Motions to Dismiss. See Cervantes, 330 F.3d at 1187; Redhair v. Kinerk, Beal, Schmidt, Dyer Sethi, P.C., 183 P.3d 544 (Ariz.App. 2008). The Court finds Cumis has adequately stated a claim that Cumis was an intended beneficiary of the sponsorship agreements.
B. Association Regulations and Third Party Beneficiary Rights
Merrick asserts that neither VISA nor MasterCard's association regulations say anything about whether the parties to the regulations intended Cumis or any credit union to be able to sue for breach of those contractual obligations. Other courts that have addressed this issue have determined that a credit card issuer, e.g., Cumis, "is at most an incidental beneficiary of the member agreement . . . but an incidental beneficiary has no right to enforce a contract." Pennsylvania State Employees Credit Union v. Fifth Third Bank, 2006 WL 1724574, *13 (M.D. Pa. 6/16/06), reversed No. 06-3405 (3rd Cir. 7/16/2008); see also Sovereign Bank v. BJ's Wholesale Club, Inc., 2006 WL 1722398, *11 (M.D.Pa. 6/16/06), reversed No. 06-3392 (3rd Cir. 7/16/2008). Merrick asserts that the agreements and the regulations make clear that Merrick's promises to VISA and MasterCard were not for the benefit of individual members of the association. See e.g., TJX Companies Retail Security Breach Litigation, 524 F.Supp.2d 83 (D.Mass. 2007).
As previously stated, in its Second Amended Complaint, Cumis asserts that the sponsorship agreements and other agreements stated that Merrick assumed responsibility for all losses caused by CardSystems' failure to fulfill the card processing obligations under Visa and MasterCard's rules and regulations. The Court finds Cumis has adequately stated a claim on which relief can be granted.
XII. Intentional Misrepresentation — Pleading with Particularity
Merrick asserts that Cumis' claim for intentional misrepresentation has not been pleaded with the requisite particularity required by Fed.R.Civ.P. 9(b). That rule requires that "a party must state with particularity the circumstances constituting fraud or mistake." Fed.R.Civ.P. 9(b). Such allegations must be specific enough "so that [defendants] can defend against the charge and not just deny that they have done anything wrong." Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 (9th Cir. 2003).
Cumis asserts that it has adequately pled that CardSystems knew that retaining magnetic data violated the card associations' rules and regulations, CardSystems kept the magnetic stripe data for extended periods of time for its own purposes, and CardSystems intentionally misrepresented to others, including the card associations and their members, that it was complying with the card associations' rules and regulations.
Merrick asserts, however, that allegations made on information and belief lack the requisite particularity required by Fed.R.Civ.P. 9(b). Laron, Inc. v. Construction Resource Services, L.L.C., 2007 WL 1958732 (D.Ariz. 7/2/07). Laron cites to In re Worlds of Wonder Secs. Litigation, 694 F.Supp. 1427, 1432-33 (N.D.Cal. 1988), for the assertion that allegations made on information and belief are insufficient unless the complaint includes the basis on which the belief is founded.
The Ninth Circuit has recognized, however, that the particularity requirements may be relaxed as to those matters which are "peculiarly within the defendant's knowledge or are readily obtainable by him." Neubronner v. Milken, 6 F.3d 666, 672 (9th Cir. 1993). Cumis has alleged that the misrepresentation and/or concealment in fact was made when CardSystems, Merrick's agent, submitted Savvis' audit report to Visa on or before June 21, 2004, and that CardSystems knew or should have known that Savvis' certification was erroneous. Cumis further alleges that Merrick knew or should have known that CardSystems' lack of compliance with CISP was a material fact and that Merrick and/or CardSystems falsely advertised CardSystems' purported CISP compliance in or after June 2004. In other words, Cumis has stated the factual basis for its belief. The Court finds that Cumis has adequately stated a claim on which relief can be granted.
XIII. Negligent Misrepresentation and Negligence
Cumis also asserted that Merrick negligently misrepresented or concealed material facts. Merrick asserts that it owed no duty to Cumis and, therefore, any claim based on negligent conduct must fail. Merrick makes this argument under Arizona law. Arizona follows the law of negligent misrepresentation as set forth in § 552(2) of the Restatement (Second) of Torts. Donnelly Construction Company v. Oberg/Hunt/Gilleland, 139 Ariz. 184, 677 P.2d 1292, 1296 (1984). The comment to that section states that the maker of a representation is liable only to the extent that the maker "intends it to reach and influence either a particular person or persons, known to him, or a group or class of person, distinct from the much larger class who might reasonably be expected sooner or later to have access to the information and foreseeably to take some action in reliance upon it." Restatement (Second) of Torts § 552(2), comment h.
Merrick asserts that section 552(2) limits the range of liability for claims based on the negligent provision of false information in a business context. Standard Chartered PLC v. Price Waterhouse, 190 Ariz. 6, 945 P.2d 317 (App. 1997). In other words, Cumis' general negligence claim must also be viewed in light of section 552(2).
Merrick asserts that no representations were made to Cumis or its insureds distinct from the larger class of all participants in the VISA and MasterCard systems. In fact, the Second Amended Complaint even alleges that the representations were made to "issuing credit unions, individual cardholders and the general public." Second Amended Complaint, ¶ 50. This argument is supported by Kuehn v. Stanley, 208 Ariz. 124, 91 P.3d 346, 349 (App. 2004), wherein the court found that a plaintiff who had access to an appraisal report completed by defendant appraiser for a lender was not one of a limited group of person protected under the Restatement. However, in Donnelly, a claim for negligent misrepresentation was valid where a defendant architect prepared site plan and engineering specifications that were subsequently relied upon by the plaintiff construction company. Cumis asserts that the misrepresentations were made to a targeted group, VISA and MasterCard, and their members. Cumis asserts that this is not a broad group and the misrepresentations were made to Cumis' insureds.
Cumis also argues that under California law a false announcement made to the general public can support claims for fraud and misrepresentation. Hauter v. Zogaris 14 Cal.3d 104, 111 (1975). Moreover, Cumis asserts that it has adequately pleaded general negligence because it has alleged that Merrick and its agent CardSystems had an ordinary duty of care to take reasonable measures to prevent foreseeable harm to Cumis. This Court, however, has determined that Arizona law is applicable in this case. Moreover, in 1992, the Supreme Court of California specifically adopted Restatement (Second) of Torts § 552(2). Bily v. Arthur Young Co., 3 Cal.4th 370, 414, 11 Cal.Rptr.2d 51 (1992).
The Court agrees with Defendants that no representations were made to Cumis or its insureds distinct from the larger class of all participants in the VISA and MasterCard systems. The application of § 552(2) mandates dismissal of the negligence claims.
Accordingly, IT IS ORDERED:
1. Savvis' Motion to Dismiss [Doc. # 81] is GRANTED IN PART AND DENIED IN PART.
2. Merrick's Motion to Dismiss [Doc. # 82] is GRANTED IN PART AND DENIED IN PART.
3. Cumis' claims for Negligent Interference with Prospective Economic Advantage (First Cause of Action), Negligent Misrepresentation against Merrick and Savvis (Fourth and Fifth Causes of Action), Negligence (Sixth Cause of Action), and Conversion/Trespass to Chattel (Seventh Cause of Action) are DISMISSED.
4. Defendants' Answer(s) shall be filed within twenty (20) days of this Order.