Opinion
MDL No. 2046, Civil Action No. H-10-171.
July 14, 2011
MEMORANDUM AND ORDER
This case arises out of a criminal intrusion into the database of Heartland Payment Systems, which processes credit-card transactions. In January 2009, Heartland Payment Systems discovered that a hacker had penetrated its database and accessed millions of credit-card numbers. The Judicial Panel on Multidistrict Litigation ("JPML") consolidated lawsuits arising out of the breach before this court. The lawsuits are divided into two tracks: one for consumers whose credit-card numbers were accessed and one for the financial institutions that issued the cards. There are two complaints on the financial institution track. One complaint is filed by a number of financial institutions and names Heartland Payment Systems as the defendant. The second complaint names Heartland Bank and KeyBank as the defendants. These two banks hired Heartland Payment Systems to process credit-card transactions for merchants that accepted Visa and MasterCard credit cards. Five of the financial institutions that sued Heartland Payment Systems — Lone Star National Bank, PBC Credit Union, O Bee Credit Union, Seaboard Federal Credit Union, and Pennsylvania State Employees Credit Union (the "Financial Institution Plaintiffs") — assert causes of action against Heartland Bank and KeyBank for breach of contract, breach of fiduciary duty, and negligence, principally based on these defendants' alleged failure to monitor the security of the Heartland Payment Systems database. This Memorandum and Order addresses the Financial Institution Plaintiffs' claims against Heartland Bank and KeyBank.
The intrusion involved debit- and credit-card information. The difference between the two is irrelevant in this litigation. For simplicity, the this court uses "credit card" to refer to both.
The plaintiffs in the case against Heartland Payment Systems are Amalgamated Bank, Matadors Community Credit Union, Lone Star National Bank, N.A., Elevations Credit Union, First Bankers Trust Co., N.A., PBC Credit Union, O Bee Credit Union, Seaboard Federal Credit Union, and Pennsylvania State Employees Credit Union.
Heartland Payment Systems has moved to dismiss the complaint against it. This Memorandum and Order does not address that motion; it will be addressed in a separate Memorandum and Order.
Heartland Bank has moved to dismiss under Rule 12(b)(6) for failure to state a claim on which relief can be granted and under Rule 12(b)(2) for lack of personal jurisdiction. (Docket Entry No. 26). KeyBank has moved to dismiss under Rule 12(b)(6). (Docket Entry No. 28). The Financial Institution Plaintiffs have responded, (Docket Entry No. 36), and Heartland Bank and KeyBank have replied, (Docket Entry Nos. 39, 40). Based on the record; the motions, response, and replies; and the relevant law, this court grants Heartland Bank's motion to dismiss under Rule 12(b)(2) but concludes that transfer, not dismissal, is the appropriate remedy. This court also grants KeyBank's motion to dismiss under Rule 12(b)(6), with leave to amend as to some, but not all, of the claims. A status conference is set for April 18, 2011, at 8:45 a.m.
All citations to the record in this opinion are to the docket in Civ. A. No. H-10-171.
The reasons for these rulings are explained below.
I. Background
In January 2010, a major breach of the Heartland Payment Systems database was discovered. Albert Gonzalez and fellow hackers obtained millions of credit-card numbers from the database before Heartland Payment Systems detected and fixed the security problem. Gonzalez was later convicted and is currently serving a prison sentence.
The Financial Institution Plaintiffs are credit-card issuers. They allege that the data breach caused them to incur expenses in the form of fraudulent charges from the stolen credit-card numbers and of the costs to cancel and reissue credit cards. The two defendant banks, Heartland Bank and KeyBank, hired Heartland Payment Systems to process credit-card transactions for merchants that accepted Visa and MasterCard credit cards.
The Visa and MasterCard networks are similar. Issuer banks, such as the Financial Institution Plaintiffs, issue credit cards to consumers. Acquirer banks, such as Heartland Bank and KeyBank, process payments for the merchants who make credit-card sales. When a consumer makes a credit-card purchase, the merchant swipes the card, sending a message to the acquirer bank. The acquirer bank then contacts the issuer bank to determine whether sufficient credit exists in the account. If so, the issuer bank clears the transaction, relays the message to the acquirer bank, which notifies the merchant. On a daily basis, the issuer bank forwards payment to the acquirer bank, which deposits the payment into the merchant's account.
Under Visa and MasterCard network regulations, only an FDIC-regulated financial institution may be an issuer or acquirer bank. (Docket Entry No. 1, ¶ 88). These banks are referred to as "members." A member may act in both issuer and acquirer roles, issuing credit to consumers and processing payments for merchants. Acquirer banks may outsource some of the processing functions to other companies. ( Id.). The Visa and MasterCard regulations require acquirer banks that enter into contracts with companies to handle processing functions to include the relevant network regulations in those contracts. ( Id., ¶ 27). The regulations, along with FDIC guidance, include security measures to protect the confidentiality of consumers' financial data. ( Id.). The Visa and MasterCard regulations also include procedures for issuer banks to claim damages resulting from a data breach and to resolve disputes relating to such a claim.
Visa's "Account Data Compromise Recovery" process allows Visa to determine the money involved in an event compromising an account, collect from the responsible member, and reimburse members who have incurred losses as a result of the event. (Docket Entry No. 28, Ex. B, ¶ 4.1.A). A member may invoke this process if the breach occurs after an event "involving non-compliance with the Payment Card Industry Data Security Standard." ( Id.). The regulations set out conditions that Visa members must meet to be reimbursed and detail the process that Visa and its members must follow after a data breach. The regulations state that "[r]eimbursement and collection amounts as determined by Visa U.S.A. are final and not subject to any appeal or other challenge." ( Id., ¶ 4.1.H).
The MasterCard regulations provide for similar dispute-resolution procedures in the event of a data breach. ( Id., Ex. C). Paragraph 5.10.4, entitled "Account, Cardholder, and Transaction Data Security," states that to recover costs from an unauthorized use of data, a member must show that a fraudulent transaction took place before MasterCard alerted an issuer to the data compromise and must show compliance with other procedures. ( Id.). The MasterCard member must show by "clear and convincing evidence" that the damages sought "resulted from" a rule violation. ( Id.).
Heartland Bank and KeyBank contracted with Heartland Payment Systems to process Visa and MasterCard credit-card transactions sent to them by participating merchants. (Docket Entry No. 25, Heartland Bank-Heartland Payment Systems Contract (Ex. A to Docket Entry No. 27); Docket Entry No. 29, KeyBank-Heartland Payment Systems Contract (Ex. A to Docket Entry No. 28)). Heartland Bank's contract with Heartland Payment Systems has an effective date of November 1, 2003; KeyBank's contract has an effective date of September 20, 2006. As required by the Visa and MasterCard regulations, each contract requires adherence to the networks' regulations. (Docket Entry No. 25, ¶ 1.1(f); Docket Entry No. 29, ¶ 1.1(f)). The contracts provide that "[i]n the event of any inconsistency between any provision of this Agreement and the by-laws and regulations of Visa and/or MasterCard, the by-laws and regulations of Visa or MasterCard in each instance shall be afforded precedence and shall apply." (Docket Entry No. 25, ¶ 1.1(h); Docket Entry No. 29, ¶ 1.1(h)). The contracts contain a confidentiality provision and require each party to indemnify the other's "affiliates." (Docket Entry No. 25, ¶¶ 4.3, 4.5; Docket Entry No. 29, ¶¶ 4.3, 4.5).
The Financial Institution Plaintiffs contend that Heartland Bank and KeyBank breached their duties under the contracts; breached their fiduciary duties as members of the Visa and MasterCard networks, which they characterize as joint ventures; and acted negligently by failing to ensure that Heartland Payment Systems complied with the Payment Card Industry Data Security Standards. The Financial Institution Plaintiffs also claim that Heartland Bank and KeyBank are vicariously liable for the negligence of Heartland Payment Systems.
KeyBank and Heartland Bank have moved to dismiss. Both defendants argue that the Financial Institution Plaintiffs have failed to state a claim on which relief may be granted, requiring dismissal under Rule 12(b)(6). Heartland Bank has also moved to dismiss under Rule 12(b)(2) for lack of personal jurisdiction. The motions are analyzed below.
II. Heartland Bank's Rule 12(b)(2) Motion
A. Personal Jurisdiction in an MDL Proceeding
Heartland Bank, a Missouri corporation with its principal place of business in Clayton, Missouri, (Docket Entry No. 1, ¶ 21), contends that it is not subject to personal jurisdiction in the Southern District of Texas. The jurisdictional reach of a federal district court is ordinarily limited by the long-arm statutes of the states in which they sit. FED. R. CIV. P. 4(k)(1)(A); uBid, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 425 (7th Cir. 2010). The long-arm statutes are, in turn, limited by federal constitutional limits. McFadin v. Gerber, 587 F.3d 753, 759 (5th Cir. 2009). The Supreme Court observed long ago, however, that "Congress could provide for service of process anywhere in the United States." Miss. Pub. Corp. v. Murphree, 326 U.S. 438, 431 (1946). "One such piece of legislation is 28 U.S.C. § 1407, the multidistrict litigation statute." In re "Agent Orange" Prod. Liab. Litig., 818 F.2d 145, 163 (2d Cir. 1985) (citing Murphree, 326 U.S. at 431). A transferee court's jurisdiction over a defendant depends on whether the transferor court had personal jurisdiction. Id.; accord In re Papst Licensing GMBH Co. KG Litig., 602 F. Supp. 2d 10, 14 (D. D.C. 2009); In re Sterling Foster Co. Secs. Litig., 222 F. Supp. 2d 289, 300 (E.D. N.Y. 2002).
The personal jurisdiction issue presented here is unusual in an MDL case because this is a directly filed suit rather than one transferred as part of the MDL. The Financial Institution Plaintiffs sued Heartland Bank and KeyBank in this Texas court after the JPML consolidated the Heartland Payment Systems cases here, asserting federal diversity jurisdiction. The parties jointly moved to consolidate this suit with those transferred in by the JPML. "Direct filing into the MDL avoids the expense and delay associated with plaintiffs filing in local federal courts around the country after the creation of an MDL and waiting for the Panel to transfer these 'tag-along' actions to this district." In re Vioxx Prods. Liab. Litig., 478 F. Supp. 2d 897, 904 (E.D. La. 2007). The JPML's rules expressly provide for joining direct filings with the MDL cases under a court's local rules without transferring through the JPML. J.P.M.L. R. 7.2(a). But direct filings may present jurisdictional, venue, or related issues. Id. at 904 n. 2; In re Norplant Contraceptive Prods. Liab. Litig., 946 F. Supp. 3, 4 (E.D. Tex. 1996) (discouraging parties from direct filing); 15 CHARLES ALAN WRIGHT, ARTHUR R. MILLER EDWARD H. COOPER, FEDERAL PRACTICE PROCEDURE § 3865 (3d ed. 2007).
Courts have expressed concern that selecting the forum by direct filing could present anomalous choice-of-law results. Vioxx, 478 F. Supp.2d at 904; In re Norplant Contraceptive Prods. Liab. Litig., 950 F. Supp. 779, 781 (E.D. Tex. 1996) (criticizing the plaintiffs for "pursu[ing] a strategy of forum-shopping by directly filing cases which have absolutely no underlying connection to this district other than the fact that the cases have been consolidated here for pretrial management under § 1407"). There does not appear to be such an effect here, however. Under either the law of Texas, where the Financial Institution Plaintiffs filed this suit, or the law of Missouri, where Heartland Bank has its headquarters, the most significant relationship test from the Restatement (Second) Conflicts of Law applies to both tort and contract actions. See DTEX, LLC v. BBVA Bancomer, S.A., 508 F.3d 785, 802 (5th Cir. 2007) (per curiam) (Texas law); Scheerer v. Hardee's Food Sys., Inc., 92 F.3d 702, 708 (8th Cir. 1996) (Missouri law). Direct filing may also affect which circuit's law applies when there are conflicting interpretations of federal law. The Fifth Circuit appears to apply the interpretation binding on the transferor court. In In re Ford Motor Co., 591 F.3d 406 (5th Cir. 2009), the Fifth Circuit issued a writ of mandamus directing the transferor court not to follow the decisions of the MDL transferee court because those decisions conflicted with Fifth Circuit precedent. The cases had originated in the Fifth Circuit and were transferred to an MDL proceeding in the Southern District of Indiana. Id. at 406 n. 15. The Fifth Circuit criticized the MDL transferee court for ignoring Fifth Circuit precedent in declining to dismiss on forum non conveniens grounds. Id. The Fifth Circuit reasoned that a § 1407 transfer "accomplishes but a change of courtrooms" and that the transferor court's circuit precedent applied. Other courts follow a different approach under § 1407. Id. In In re Korean Airlines Disaster of Sept. 1, 1983, 829 F.2d 1171, 1174 (D.C. Cir. 1987), the D.C. Circuit held that MDL transferee courts need not defer the interpretation prevailing in the transferor court's circuit. "Following this decision, the circuit and district courts have uniformly applied the law of the transferee circuit to issues of federal law." In re Methyl Tertiary Butyl Ether ("MTBE") Prods. Liab. Litig., No. 1:00-1898, MDL 1358 (SAS), M21-88, 2005 WL 106936, at *4 n. 37 (S.D. N.Y. Jan. 18, 2005) (citing decisions of the Second, Fourth, Seventh, Eighth, Ninth, and Eleventh Circuits); see also In re Nazi Era Cases Against German Defendants Litig., 153 F. App'x 819, 823 n. 2 (3d Cir. 2005) (citing Korean Air Lines, 829 F.2d at 1176); In re Litig. Involving Alleged Loss of Cargo from Tug Atl. Seahorse, "Sea Barge 101" Between P.R. and Fla. in Dec. 1988, 772 F. Supp. 707, 711 (D. P.R. 1991).
Alleged defects in personal jurisdiction are not unique to direct-filed cases in the MDL context. See, e.g., ClassicStar Mare Lease, 2008 WL 3077732, at *4 (dismissing a case transferred under § 1407 for lack of personal jurisdiction). In some cases, a defendant facilitates direct filing through a stipulation waiving personal jurisdiction for the pretrial proceedings under § 1407. In the Vioxx litigation, for example, the primary defendant, Merck Co., Inc., agreed to allow all actions against it to be filed directly in the Eastern District of Louisiana, where the JPML had consolidated the cases under § 1407, subject to the stipulation that the court would transfer the cases under 28 U.S.C. § 1404(a) at the close of pretrial proceedings to a venue satisfying 28 U.S.C. § 1391. Vioxx, 478 F. Supp. at 904.
The parties attempted to reach a stipulation before jointly moving to consolidate this suit with those transferred by the JPML. As late as May 19, 2010, the Financial Institution Plaintiffs offered the following stipulation:
[C]ounsel for the Plaintiffs and Heartland Bank believe that . . . the action against Heartland Bank is already included in the MDL 2046 proceedings. As a result, Heartland Bank has agreed to abandon the arguments made in its motion to dismiss with respect to this Court's purported lack of personal jurisdiction over Plaintiff's claims. This withdrawal is without prejudice to [Heartland Bank] arguing that this Court lacks personal jurisdiction over it for any trial proceedings. See 28 U.S.C. § 1407(a) (referring to the transfer of related cases to a single forum for coordinated or consolidated "pretrial proceedings"). In turn, Plaintiffs also reserve the right to argue that this Court has sufficient personal jurisdiction over Heartland Bank to permit it to preside over any subsequent trial proceedings.
(Docket Entry No. 36 at 9-10 (alterations in original)). Heartland Bank refused the stipulation, apparently fearing that it would be insufficient to preserve the objection to personal jurisdiction after pretrial proceedings concluded. Heartland Bank explains:
As an alternative, Heartland Bank proposed that Plaintiffs stipulate that there is no personal jurisdiction over Heartland Bank in the direct action in this Court and the parties would then stipulate, and this Court would order, that the claims against Heartland Bank be treated as having been transferred to the United States District Court for the Eastern District of Missouri, which would have personal jurisdiction over Heartland Bank, and then returned to this Court as a 'tag along' action pursuant to MDL procedures, with this Court's clerk notifying the clerk in the Eastern District of Missouri and the clerk of the MDL Panel. Heartland Bank believes that such an approach would preserve its due process rights while at the same time minimizing any delay that would be caused by a circuitous transfer of claims against Heartland Bank.
(Docket Entry No. 39 at 3 n. 1). Unable to reach an agreement, Heartland Bank moved to dismiss under Rule 12(b)(2).
The Financial Institution Plaintiffs argue that Heartland Bank is properly sued in Texas. But even if Heartland Bank is not subject to personal jurisdiction in this court, they argue that the motion to dismiss is "pointless and clearly a delay tactic." (Docket Entry No. 36 at 10). If this court dismisses for lack of personal jurisdiction, the Financial Institution Plaintiffs plan to refile in a court where Heartland Bank is subject to personal jurisdiction, then file a tag-along motion with the JPML, leading to a transfer to this court. The only result, they argue, would be delay. Heartland Bank maintains that it must be dismissed if it is not subject to personal jurisdiction in Texas.
Each argument is analyzed below.
B. The Legal Standard for Personal Jurisdiction
This court must determine whether it has personal jurisdiction over Heartland Bank before making any decision on the merits. See Sinochem Int'l Co. v. Malay. Int'l Shipping Corp., 549 U.S. 422, 430 (2007) (citing Steel Co. v. Citizens for Better Env't, 523 U.S. 83, 93-102 (1998)). A federal court sitting in diversity may exercise personal jurisdiction over a nonresident defendant if the long-arm statute of the forum state confers personal jurisdiction over that defendant and the exercise of such jurisdiction by the forum state is consistent with due process under the United States Constitution. Delgado v. Reef Resort, Ltd., 364 F.3d 642, 644 (5th Cir. 2004). The Texas long-arm statute, TEX. CIV. PRAC. REM. CODE § 17.041-.045, confers jurisdiction to the limits of due process. Stroman Realty, Inc. v. Antt, 528 F.3d 382, 385 (5th Cir. 2008); Religious Tech. Ctr. v. Liebreich, 339 F.3d 369, 373 (5th Cir. 2003). Due process permits the exercise of personal jurisdiction over a nonresident defendant when the defendant has "minimum contacts" with the forum state and the exercise of jurisdiction over the defendant does not offend "traditional notions of fair play and substantial justice." Johnston v. Multidata Sys. Int'l Corp., 523 F.3d 602, 609 (5th Cir. 2008) (quoting Wilson v. Belin, 20 F.3d 644, 647 (5th Cir. 1994)).
The "minimum contacts" aspect of the analysis can be established through "contacts that give rise to 'specific' personal jurisdiction and those that give rise to 'general' personal jurisdiction." Wilson, 20 F.3d at 647. A court may exercise specific jurisdiction when the nonresident defendant's contacts with the forum state arise from, or are directly related to, the cause of action. Gundle Lining Constr. Corp. v. Adams Cnty. Asphalt, Inc., 85 F.3d 201, 205 (5th Cir. 1996) (citing Helicopteros Nacionales de Colom., S.A. v. Hall, 446 U.S. 408, 414 n. 8 (1984)); Religious Tech., 339 F.3d at 375; Quick Techs., Inc. v. Sage Grp. PLC, 313 F.3d 338, 344 (5th Cir. 2002). To determine whether specific jurisdiction exists, a court must "examine the relationship among the defendant, the forum, and the litigation to determine whether maintaining the suit offends traditional notions of fair play and substantial justice." Gundle Lining Constr., 85 F.3d at 205; see also Helicopteros Nacionales, 466 U.S. at 414 n. 8. Even a single contact can support specific jurisdiction if the defendant "purposefully avails itself of the privilege of conducting activities within the forum state, thus invoking the benefits and protections of its laws." Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985). "The non-resident's 'purposeful availment' must be such that the defendant 'should reasonably anticipate being haled into court' in the forum state." Ruston Gas Turbines, Inc. v. Donaldson Co., Inc., 9 F.3d 415, 419 (5th Cir. 1993) (citing World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980)). Specific jurisdiction requires a sufficient nexus between the nonresident defendant's contacts with the forum and the cause of action. Rittenhouse v. Mabry, 832 F.2d 1380, 1390 (5th Cir. 1987). As part of the minimum contacts analysis, a court evaluates any contracts, the parties' "actual course of dealing," and the parties' "prior negotiations and contemplated future consequences." Rudzewicz, 471 U.S. at 479.
When the cause of action does not arise from or relate to the foreign defendant's purposeful conduct within the forum state, due process requires that the foreign defendant have engaged in continuous and systematic contacts with the forum state before a court may exercise general personal jurisdiction. Helicopteros Nacionales, 466 U.S. at 414-15; Bearry v. Beech Aircraft Corp., 818 F.2d 370, 374 (5th Cir. 1987). The plaintiff must demonstrate contacts of a more extensive quality and nature between the forum state and the defendant than those needed to support specific jurisdiction. Dalton v. R W Marine, 897 F.2d 1359, 1362 (5th Cir. 1990). "To exercise general jurisdiction, the court must determine whether 'the contacts are sufficiently systematic and continuous to support a reasonable exercise of jurisdiction.'" Holt Oil Gas Corp. v. Harvey, 801 F.2d 773, 777 (5th Cir. 1986) (quoting Stuart v. Spademan, 772 F.2d 1185, 1191 (5th Cir. 1985) (additional citations omitted)). "The 'continuous and systematic contacts test is a difficult one to meet, requiring extensive contacts between a defendant and a forum.'" Jackson v. Tanfoglio Giuseppe, S.R.L., 615 F.3d 579, 584 (5th Cir. 2010) (quoting Johnston, 523 F.3d at 609). General jurisdiction may exist only if a corporate defendant has "a business presence in the forum state." Id. (citing Access Telecom, Inc. v. MCI Telecomm. Corp., 197 F.3d 694, 717 (5th Cir. 1999)) (emphasis in original).
The Financial Institution Plaintiffs have the burden of showing personal jurisdiction over Heartland Bank. See Luv n' care, Ltd. v. Insta-Mix, Inc., 438 F.3d 465, 469 (5th Cir. 2006) (citing Wyatt v. Kaplan, 686 F.2d 276, 280 (5th Cir. 1982)); Wilson, 20 F.3d at 648. The court must accept as true a party's uncontroverted allegations and resolve any factual conflicts in favor of the party seeking to invoke the court's jurisdiction. Cent. Freight Lines Inc. v. APA Transp. Corp., 322 F.3d 376, 380 (5th Cir. 2003); Stripling v. Jordan Prod. Co., LLC, 234 F.3d 863, 869 (5th Cir. 2000); Alpine View Co. v. Atlas Copco AB, 205 F.3d 208, 215 (5th Cir. 2000). The law, however, does not require the court to credit conclusory allegations, even if uncontroverted. Panda Brandywine Corp. v. Potomac Elec. Power Co., 253 F.3d 865, 869 (5th Cir. 2001). When a court rules on a motion to dismiss for lack of personal jurisdiction without holding an evidentiary hearing, the party asserting jurisdiction must present facts sufficient to constitute a prima facie case of personal jurisdiction. See Cent. Freight Lines, 322 F.3d at 380; Brown v. Slenker, 220 F.3d 411, 417 (5th Cir. 2000); Alpine View, 205 F.3d at 215. Proof by a preponderance of the evidence is not required. See Luv n' care, 438 F.3d at 469.
C. Analysis
a. Waiver
The Financial Institution Plaintiffs, relying on PaineWebber Inc. v. Chase Manhattan Private Bank (Switzerland), 260 F.3d 453 (5th Cir. 2001), argue that Heartland Bank has waived its objection to personal jurisdiction by joining the motion to transfer the case to this court. Personal jurisdiction may be waived. Rudzewicz, 471 U.S. at 473 n. 14; Ins. Corp. of Ir., Ltd. v. Compagnie des Bauxites de Guinee, 456 U.S. 694, 703 (1982) ("Because the requirement of personal jurisdiction represents first of all an individual right, it can, like other such rights, be waived."); PaineWebber, 260 F.3d at 461 (citing Rudzewicz, 471 U.S. at 473 n. 14). Whether a party has consented to a particular jurisdiction is a question of federal law. Haynsworth v. The Corporation, 121 F.3d 956, 962 (5th Cir. 1997). A waiver occurs when a party demonstrates "express or implied consent to the personal jurisdiction to the court." Rudzewicz, 471 U.S. at 473 n. 14 (quoting Ins. Corp. of Ir., 256 U.S. at 703).
PaineWebber does not support the Financial Institution Plaintiffs' position. In PaineWebber, the court noted that "a motion for transfer is fully consistent with an objection to personal jurisdiction, as a court may transfer a case even though it lacks personal jurisdiction." 260 F.3d at 460 n. 7. A party may waive objections to personal jurisdiction by filing an action in the forum, asserting counterclaims for affirmative relief, or litigating extensively on the merits before making a jurisdictional objection. Id. at 460. None of those occurred here. Instead, the parties agreed to transfer the case to this court to be joined with the other cases arising out of the Heartland Payment Systems breach. Transferring to the MDL court is consistent with preserving the right to seek dismissal for lack of personal jurisdiction. See, e.g., ClassicStar Mare Lease, 2008 WL 3077732, at *4 (dismissing a case transferred under § 1407 for lack of personal jurisdiction). Heartland Bank timely filed its motion to dismiss under Rule 12(b)(2). There is no waiver.
b. Minimum Contacts
Heartland Bank asserts that it cannot be subjected to personal jurisdiction in Texas. The Financial Institution Plaintiffs contend that Heartland Payment Systems functioned as Heartland Bank's agent by processing transactions in Texas and soliciting merchants to process transactions under the contract. In an affidavit, David P. Minton, Heartland Bank's president and chief executive officer, states that the company's offices are located in Missouri and Colorado with the principal office in Missouri; Heartland Bank has no branches, employees or business operations in Texas and owns no Texas property; neither Heartland Bank nor Heartland Payment Systems is a Texas corporation; the contract between Heartland Bank and Heartland Payment Systems was not negotiated in Texas or subject to Texas law; all services performed by Heartland Bank under the contract are performed in Missouri; and all Heartland Bank's accounts relevant to the contract are maintained in Missouri. (Docket Entry No. 27, Ex. A). The Financial Institution Plaintiffs do not controvert any of these facts. Instead, they argue that Heartland Bank is subject to personal jurisdiction in Texas because the Heartland Payment Systems processing center is located in this State. For support, the Financial Institution Plaintiffs cite their complaint against Heartland Payment Systems, not the complaint in this case. (Docket Entry No. 36 at 13).
The "minimum contacts" analysis focuses on purposeful availment of the forum state. The "fortuitous 'unilateral activity' of a third party" in a forum state does not subject a defendant to personal jurisdiction in that state. Johnston, 523 F.3d at 611 (quoting Helicopteros, 466 U.S. at 416-17). When a defendant contracts with a forum plaintiff, if "the forum plaintiff's decision to perform its contractual obligation within its own forum state is totally unilateral, it cannot be viewed as purposeful on the part of the nonresident." Command-Aire Corp. v. Ontario Mech. Sales Serv. Inc., 963 F.2d 90, 94 (5th Cir. 1992); Dubea v. Simpson, Civ. A. No. 9:07-CV-63-TH JURY, 2009 WL 528258, at *4 n. 1 (E.D. Tex. Mar. 2, 2009). A review of Fifth Circuit decisions analyzing minimum contacts in breach-of-contract cases provides helpful guidance. Although minimum contacts analysis is "claim-specific," Willow Bend, L.L.C. v. Downtown ABQ Partners, L.L.C., 612 F.3d 390, 393 (5th Cir. 2010) (summary calendar), the contract cases are the most relevant, because the Financial Institution Plaintiffs' argument for personal jurisdiction focuses on the contractual relationship between Heartland Bank and Heartland Payment Systems and conduct that allegedly breached the contract. The Fifth Circuit has repeatedly held that merely contracting with a resident of the forum state is insufficient to subject the nonresident defendant to personal jurisdiction in that state. Other insufficient contacts include mailing payments to the forum state, engaging in communications related to the execution and performance of the contract in the forum state, and even sending representatives to the forum state.
In Hydrokinetics, Inc. v. Alaska Mechanical, Inc., 700 F.2d 1026 (5th Cir. 1983), the court held that personal jurisdiction was lacking over an Alaska corporation that agreed to purchase goods manufactured in Texas, agreed to pay for the goods in Texas, communicated extensively with the plaintiff before contracting, and sent representatives to Texas twice, once to inspect the manufacturing facilities and once to resolve a dispute relating to the contract. Id. at 1028-29. Although the plaintiff was to perform the contractual obligations in Texas, the defendant's contractual performance in Texas was limited to paying for the goods. Id. The defendant did not regularly engage in business outside Alaska and the agreement to purchase the goods was "initiated by and substantially negotiated with" one of the plaintiff's representatives in Alaska. Id. The court noted that the case involved a single transaction as opposed to a continuing relationship with the forum state. Id. The court also found it significant that the contract provided for the application of Alaska law and that the plaintiff delivered the products to the defendant outside Texas. Id. The facts that the defendant sent payments to Texas and that the parties communicated from their respective locations during contract negotiations did not weigh in favor of exercising jurisdiction in Texas. Id. The court concluded: "considering the totality of the facts of this case, the necessary inference of purposeful availment is not supported." Id. at 1029-30.
In Stuart, the court determined that a Texas court did not have personal jurisdiction over an individual defendant who entered into a contract with a Texas resident, shipped goods into Texas for modification, sent letters and made telephone calls to the plaintiffs in Texas, received communications from the plaintiffs, agreed to a choice-of-law provision selecting Texas law, and mailed payments to Texas. 772 F.2d at 1192-1194. The court concluded that it was the quality of the forum-state contacts, not the number or timing, that was important to the minimum-contacts analysis. The nonresident defendant's contacts were not of a sufficient quality to show that the defendant purposefully availed itself of the benefits of conducting business in Texas. The choice-of-law provision was insufficient, standing alone or considered with the other contacts, to justify the exercise of personal jurisdiction over the defendant. Id. at 1196. The court concluded that the "provision contemplate[d] a choice of law not forum" and thus did not "evince [plaintiffs'] anticipation of being haled into a Texas court." Id. at 1195.
In Gundle Lining Construction, 85 F.3d at 205, the court found personal jurisdiction based on the defendant's contract with the forum-state plaintiff, combined with the facts that the defendant mailed payments to the plaintiff in the forum state and engaged in communications with the plaintiff during the negotiation and performance of the contract. The key difference between Stuart and Gundle Lining Construction was a contract provision that allowed the plaintiff to file suit "to recover on the labor and materialman's bond" in any "State in which such labor was performed, services rendered, or materials furnished." Id. at 206. The court acknowledged that although the provision was neither a choice-of-law nor a choice-of-forum clause, it "resemble[d] the latter." Id. Because labor under the contract was performed in the forum state, the exercise of personal jurisdiction over the nonresident defendant was not unreasonable. Id.
A few years after Gundle Lining Construction, the court found that, despite a choice-of-law provision in the parties' contract selecting the law of India, a Texas court could exercise personal jurisdiction over the Indian defendant who, as a result of "extensive negotiations," entered into a contract with the plaintiff in Texas. Electrosource, Inc. v. Horizon Battery Techs., Ltd., 176 F.3d 870, 872 (5th Cir. 1999). The defendant in Electrosource solicited the plaintiff's business in Texas, contemplated an ongoing relationship with the Texas plaintiff, corresponded extensively with the plaintiff in Texas, sent at least six different representatives to Texas on six separate visits related to the contract, and made contract payments to the plaintiff in Texas. Id. at 872. The plaintiff contracted to train the defendant's employees in Texas, to provide design assistance and advice to the defendant in Texas, and to monitor the defendant's product uniformity and quality control at least partially from Texas. Id. at 872-73. The court noted that the "actual course of dealing . . . involved wide reaching contacts and contemplated future consequences with the forum state." Id. The court summarized the defendant's significant contacts with the forum state:
[The defendant] sought out [the plaintiff] for a particular technology that had been developed in [the forum state], negotiated for its acquisition in [the forum state], entered into an agreement for the transfer of technology in [the forum state], and began the process of training, designing, and preparation in [the forum state] necessary to the transfer of technology."Id. at 873-74. The court distinguished Hydrokinetics, Inc. on the basis of the greater quantity and quality of the nonresident's contacts with the forum state. See id. at 873.
Similarly, in Central Freight Lines Inc. v. APA Transport Corp., 322 F.3d 376 (5th Cir. 2003), the long-term nature of the agreement was important to the court's personal jurisdiction analysis. In that case, the nonresident defendant sent two representatives to the forum state for a preliminary meeting that ultimately led to negotiations and a long-term agreement under which the parties would use each other's services. Id. at 379, 382. The parties negotiated the contract via telephone and written communications. Id. at 382. The court found that because the contract contemplated a long-term relationship, the defendant's contacts with the forum state could not be "characterized as random, fortuitous, or attenuated." Id. at 383 (internal quotation marks omitted). Rather, the court concluded that the nonresident defendant purposefully affiliated itself with a company based primarily in the forum state and with its customers primarily from the forum state. Id. at 382. Even though the nonresident defendant, a freight delivery company, did not pick up or deliver freight in the forum state, it "took purposeful and affirmative action by entering into the [agreement], providing [the plaintiff] with pricing and shipping information, and agreeing to accept shipments" from the forum state "that had the clearly foreseeable effect of causing business activity in the forum state." Id. (internal quotation marks omitted).
In Big Easy Energy, LLC v. Conglomerate Gas, Civ. A. No. 09-3231, 2010 WL 1038225 (E.D. La. Mar. 17, 2010), an energy company hired a New Orleans-based corporation, Big Easy Energy, to help it locate and purchase oil and gas properties in Texas. Big Easy conducted its search from its New Orleans office and held a meeting with an out-of-state employee of a company with some holdings in Texas in the office. Id. at *4. In declining to give weight to those contacts, the court noted that "[a]lthough Defendants could have reasonably anticipated that Plaintiff, as a Louisiana entity, would perform its obligations under the contract in Louisiana, Plaintiff has not alleged that the contract contemplated performance within Louisiana. Thus, Plaintiff's performance was not a purposeful contact by Defendants, and its weight in the personal jurisdiction calculation is necessarily diminished." Id. (quotation and alteration omitted); see also St. Martin Mahoney, A.P.L.C. v. Diversified Aircraft Holdings, Ltd., 934 F. Supp. 200, 205 (E.D. La. 1996) (attributing no weight to the plaintiff's decision to sign a bill of sale in the forum).
In Southwest Offset, Inc. v. Hudco Publishing Co., Inc., the Texas court found personal jurisdiction over an Alabama publisher sued for breach of contract by a Texas printer. 622 F.2d 149, 152 (5th Cir. 1980). The plaintiff's sales representative had solicited the defendant in Alabama to have the plaintiff print its telephone directories. After the initial order, the defendant placed eight orders in writing or over the phone with the plaintiff in Texas. The defendant sent some payments to the plaintiff's office in Texas. No one associated with the defendant ever visited Texas. Printing the directories involved the efforts of both parties: the defendant in Alabama prepared camera-ready copy, which it sent to the plaintiff in Texas; the plaintiff then prepared proofs, which were sent back to Alabama for the defendant's approval; the defendant returned the corrected proofs to the plaintiff in Texas; the plaintiff printed the phone books and sent them to defendant F.O.B. Dallas. Id. at 150. The court noted that Texas was "probably the place of most of the contracts, since all except the first of [the defendant's] offers to print were accepted by [plaintiff] in Texas." Id. at 152. The court emphasized that the Alabama defendant was "no mere passive customer" of the Texas plaintiff because the defendant was actively engaged in the preparation of each separate order and sending the copies to Texas was a "necessary part of [its] contract performance." Id. The nature of the orders for printing showed that the defendant's contacts with Texas were not "single and fortuitous," but rather repetitive and sustained. Id.
Similarly, in Duke Energy International, L.L.C. v. Napoli, ___ F. Supp. 2d ___, 2010 WL 3749298 (S.D. Tex. Sept. 21, 2010), the court focused on the defendants' long-term relationship with the forum. In that case, an energy company sued nonforum for inducing its employees to breach their fiduciary duties by purchasing a power plant and selling it to the energy company at an inflated price. Id. at *1. The company created to purchase the power plant, Artale, had its principal place of business in Houston. Id. at *15. The court distinguished Stuart, noting that the defendants "ongoing relationships" with Artale and that the defendants specifically targeted the plaintiff, a Houston-based company, as the buyer for the plant. The defendants specifically targeted the energy company's Houston insiders to usurp the corporate opportunity and resell the plant to the energy company. Id.
Like this case, Duke Energy was not a breach of contract case, but the claims centered on contractual relationships.
The Fifth Circuit reached the opposite conclusion in Moncrief Oil International Inc. v. OAO Gazprom, 481 F.3d 309 (5th Cir. 2007). The court distinguished cases finding personal jurisdiction when a defendant contracted with "a plaintiff that only existed within the forum state, and [the] defendant actively engaged in the various activities taking place therein." Id. at 313. In Moncrief, by contrast, the plaintiff was headquartered in Texas but had locations internationally, and the defendant was not actively engaged in any of the plaintiff's activities in Texas. The plaintiff, a Texas corporation, filed suit in Texas against several Russia-based defendants for breach of contract. The contract was negotiated and executed in Russia and provided for arbitration in Russia, under Russian law. The plaintiff argued that the Russian defendants had established minimum contacts with Texas by: contracting with the plaintiff with knowledge that the plaintiff was a Texas resident; acknowledging and approving of the plaintiff's substantial contract performance in Texas; and sending an executive to visit Texas in furtherance of that performance. The plaintiff cited Central Freight Lines to argue that personal jurisdiction existed over the Russian defendants because it was reasonably foreseeable to them that the Texas plaintiff would perform a material part of the contractual obligations in Texas and thereby cause business activity in Texas. The court rejected the plaintiff's argument. Id. In addition to the facts that the plaintiff had locations internationally, and the defendants were not actively engaged in any of the plaintiff's activities in Texas, "[t]he contract was silent as to location" and there was "no indication that the location of the performance mattered" or that the defendants had contracted with the plaintiff because of its Texas headquarters. Id.
Heartland Payment Systems is not a Texas company and does not exist "only within the forum state." Heartland Payment Systems is headquartered in New Jersey. The present case did involve long-term contract performance. But, as in Moncrief, there is no basis to conclude that Heartland Bank engaged in a purposeful or affirmative act that would subject it to jurisdiction in Texas. Unlike the cases finding personal jurisdiction, there is no evidence that Heartland Bank was actively engaged in the plaintiff's contractual performance in the forum state.
The contract with Heartland Payment Systems illustrates Heartland Bank's indifference toward Texas. The contract contemplates two categories of services: payment processing and customer solicitation. The contract does not state where the payment processing will take place. Nor is there any indication in the contract that Heartland Bank has any right to take an active role in payment processing. The contract sets out rules, primarily by subjecting Heartland Payment Systems to the Visa and MasterCard regulations, but there is no right to direct compliance. ( See Docket Entry No. 25, ¶¶ 1.1(e)-(f), 1.1(h)). The contract permits Heartland Bank or a designee to "conduct an inspection or audit of HPS records and materials relative to its Program and HPS' accounting or auditing procedures regarding its program. "If [Heartland] Bank . . . reasonably concludes that it is exposed to undue financial risk or exposure based on the internal controls and security procedures of HPS," Heartland Bank's only recourse is to provide written notice of its dissatisfaction. ( Id., ¶ 4.6). That notice must be provided to the New Jersey headquarters, not to the processing center. ( Id., ¶ 4.8). Heartland Payment Systems then must remedy the problem. ( Id., ¶ 4.6). If they cannot agree on an appropriate remedy, termination, not intervention, is the result. ( Id.).
By contrast, the contract contemplates active involvement with the sales operations based out of the New Jersey Heartland Payment Systems headquarters. Heartland Payment Systems represented in the contract that it maintained a sales office in Princeton and had sales representatives throughout the United States, but there was no representation regarding the Texas processing center. ( Id., ¶ 1.1(g)). Heartland Bank is entitled to "written notice of any sales locations or any changes in the location of the current sales office," but no information on the processing center. Heartland Bank has the right to reject any merchant applicant, at which point Heartland Payment Systems must "promptly terminate" the merchant. ( Id., ¶¶ 1.2(c)-(d), 1.3). The paragraph requiring Heartland Payment Systems to pay any taxes Heartland Bank incurred under the contract specifically mentions New Jersey and Missouri, but not Texas. ( Id., ¶ 4.10). Missouri law governs the contract. ( Id., ¶ 4.11). The Texas aspect of the Heartland Payment Systems-Heartland Bank relationship does not support specific jurisdiction in Texas.
The Financial Institution Plaintiffs also argue that Heartland Bank is subject to jurisdiction in Texas because of its participation in the Visa and MasterCard networks. The Fifth Circuit rejected a similar argument in Choice Healthcare, Inc. v. Kaiser Foundation Health Plan of Colorado, 615 F.3d 364 (5th Cir. 2010). In that case a Louisiana healthcare provider sued a Colorado insurer. The provider contended that the insurer was subject to specific jurisdiction in Louisiana based on the insurer's membership in a national network, one of whose benefits was discounted care in the forum. The Fifth Circuit concluded, based on a prior unpublished opinion, the membership in the network was purposeful availment of the network, not of Louisiana. Id. at 371. The district court in the previous case had reasoned that the contract was not with any forum entity, but with the national organization. Id. (citing St. Luke's Episcopal Hosp. v. La. Health Serv. Indem. Co., Civ. A. No. 2009 WL 47125, at *9 (S.D. Tex. Jan. 6, 2009)).
The Choice Healthcare court relied in part on a case similar to this case, Resolution Trust Corp. v. First of America Bank, 796 F. Supp. 1333 (C.D. Cal. 1992). The defendant was a Michigan bank with no California contacts, but it participated in a nationwide fund clearinghouse system that facilitated wire transfers for the bank's customers in states where the bank had no presence. Id. at 1334. The plaintiff, a California member of the system, wired money to the Michigan bank. When it discovered it had transferred too much money, the California bank attempted to debit the Michigan bank account. The Michigan bank refused. The California bank contended that the Michigan bank's membership in the association subjected it to personal jurisdiction in California. Id. at 1337. The court disagreed. "[T]he defendant Michigan bank did not contract with any California entity. Both banks simply belong to a clearinghouse service. This does not establish a California contract, a contract between the parties, a substantial connection to California purposeful availment of California." Id. Memberships in the Visa and MasterCard networks does not subject Heartland Bank to personal jurisdiction in Texas.
Nor is there a basis for finding general jurisdiction over Heartland Bank. As noted, the general jurisdiction standard is a "difficult one to meet, requiring extensive contacts between a defendant and a forum." Jackson, 615 F.3d at 584 (quoting Johnston, 523 F.3d at 609). The Financial Institution Plaintiffs have not showed that Heartland Bank has "a business presence in" Texas. Jackson, 615 F.3d at 579 (emphasis in original); see also Wiedman v. Citywide Banks, No. 08-3548, 2009 WL 117873, at *1 (E.D. Pa. Jan. 15, 2009) (rejecting the argument that a Colorado bank offering "national . . . merchant credit card services" was subject to general jurisdiction in Pennsylvania when the record contained no evidence that the services brought the bank into contact with Pennsylvania). Heartland Bank's offices are located in Missouri and Colorado only. It has no business presence in Texas.
Unlike cases transferred under § 1407, which requires such cases to be remanded to the transferee court, see In re W. States Wholesale Natural Gas Antitrust Litig., MDL No. 1566, 2010 WL 2539728, at *6 (D. Nev. June 4, 2010) (citing Lexecon Inc. v. Milberg Weiss Bershad Hynes Lerach, 523 U.S. 26, 28 (1998)), this case may be transferred to cure the jurisdictional defect, see Sinochem, 549 U.S. at 430 (citing Goldlawr, Inc. v. Heiman, 369 U.S. 463, 466 (1962)). A court has discretion to transfer even if no party requests it. Horton v. Cockrell, 71 F.3d 877, 1995 WL 725375, at *4 (5th Cir. 1995) (per curiam) (unpublished) (citing Mills v. Beech Aircraft Corp., 886 F.2d 758, 761 (5th Cir. 1989); 14D WRIGHT, MILLER COOPER § 3827 ("If venue is proper for some defendants but improper for others, the district court has wide discretion," including to sever the case and "transfer the severed portion of the case for those defendants for whom venue is improper."). Transfer is consistent with the efficiency concerns raised by the Financial Institution Plaintiffs. The topics addressed at the status conference set for April 18 will include whether and where to transfer the case against Heartland Bank. See Self v. M M Chem. Co., 177 F.3d 977, 1999 WL 199576, at *4 (5th Cir. Mar. 17, 1999) (per curiam) (unpublished) (recommending supplemental briefing to determine an appropriate transfer venue).
III. KeyBank's Motion to Dismiss under Rule 12(b)(6)
A. Rule 12(b)(6)
A complaint may be dismissed under Rule 12(b)(6) for "failure to state a claim upon which relief can be granted." FED. R. CIV. P. 12(b)(6). In Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007), and Ashcroft v. Iqbal, ___ U.S. ___, 129 S. Ct. 1937 (2009), the Supreme Court confirmed that Rule 12(b)(6) must be read in conjunction with Rule 8(a), which requires "a short and plain statement of the claim showing that the pleader is entitled to relief." To withstand a Rule 12(b)(6) motion, a complaint must contain "enough facts to state a claim to relief that is plausible on its face." Twombly, 550 U.S. at 570; see also Elsensohn v. St. Tammany Parish Sheriff's Office, 530 F.3d 368, 372 (5th Cir. 2008) (quoting Twombly, 550 U.S. at 570). The Court explained that "the pleading standard Rule 8 announces does not require 'detailed factual allegations,' but it demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation." Iqbal, 129 S. Ct. at 1949 (citing Twombly, 550 U.S. at 555).
A court generally cannot consider documents that are not attached to the pleadings when ruling on a motion to dismiss. A court can consider documents supplied by the defendant in a motion to dismiss "if they are referred to in the plaintiff's complaint and are central to her claim." Collins v. Morgan Stanley Dean Witter, 224 F.3d 496, 499 (5th Cir. 2000) (quoting Venture Assocs. Corp. v. Zenith Data Sys. Corp., 987 F.2d 429, 431 (7th Cir. 1993); see also Branch v. Tunnell, 14 F.3d 449, 453-54 (9th Cir. 1994); Field v. Trump, 850 F.2d 938, 949 (2d Cir. 1988); Sheppard v. Tex. Dep't of Transp., 158 F.R.D. 592, 595 (E.D. Tex. 1994). These documents "merely assist [] the plaintiff in establishing the basis of the suit, and the court in making the elementary determination of whether a claim has been stated." Id.
In addition to the complaint, this Memorandum and Order relies on three documents: KeyBank's November 1, 2003 contract with Heartland Payment Systems, (Docket Entry No. 29), and the Visa and MasterCard regulations, (Docket Entry No. 27, Exs. B, C (excerpts)). The Financial Institution Plaintiffs' contract claim is based on KeyBank's contract with Heartland Payment Systems. The complaint alleges that the Financial Institution Plaintiffs are "intended third-party beneficiaries of contracts entered into between Defendants and various entities," including "the MPA's between Defendants and Heartland [Payment Systems]." (Docket Entry No. 1, ¶ 118). The complaint repeatedly refers to the Visa and MasterCard regulations. ( See, e.g., id., ¶¶ 42, 42-54). The regulations are the foundation of the Financial Institution Plaintiffs' claim for breach of fiduciary duty, ( id., ¶ 124 ("By virtue of their membership in the Visa and MasterCard Associations, the operating rules and regulations of such Associations and the applicable law and regulations, Defendants . . . and Plaintiffs . . . were (and continue to be) in confidential, special, and fiduciary relationships with each other. . . .")). These documents are properly considered in ruling on the motion to dismiss.
When a plaintiff's complaint fails to state a claim, the court should generally give the plaintiff at least one chance to amend the complaint under Rule 15(a) before dismissing the action with prejudice. See Great Plains Trust Co. v. Morgan Stanley Dean Witter Co., 313 F.3d 305, 329 (5th Cir. 2002) ("[D]istrict courts often afford plaintiffs at least one opportunity to cure pleading deficiencies before dismissing a case, unless it is clear that the defects are incurable or the plaintiffs advise the court that they are unwilling or unable to amend in a manner that will avoid dismissal."); see also United States ex rel. Adrian v. Regents of the Univ. of Cal., 363 F.3d 398, 403 (5th Cir. 2004) ("Leave to amend should be freely given, and outright refusal to grant leave to amend without a justification . . . is considered an abuse of discretion." (internal citation omitted)). However, a plaintiff should be denied leave to amend a complaint if the court determines that a "proposed amendment . . . clearly is frivolous [and] advanc[es] a claim or defense that is legally insufficient on its face." 6 CHARLES ALAN WRIGHT, ARTHUR R. MILLER MARY KAY KANE, FEDERAL PRACTICE PROCEDURE § 1487 (3d ed. 2007); see also Ayers v. Johnson, 247 F. App'x 534, 535 (5th Cir. 2007) (unpublished) (per curiam) ("'[A] district court acts within its discretion when dismissing a motion to amend that is frivolous or futile.'" (quoting Martin's Herend Imports, Inc. v. Diamond Gem Trading U.S. of Am. Co., 195 F.3d 765, 771 (5th Cir. 1999))).
B. The Breach of Contract Claim
The Financial Institution Plaintiffs allege that the criminal intrusion into the Heartland Payment Systems database resulted from KeyBank's breach of its November 1, 2003 contract with Heartland Payment Systems. The Financial Institution Plaintiffs contend that they are third-party beneficiaries of the contract. They point out that the contract has no provision precluding third-party suits and argue that the context shows that they were intended beneficiaries of the contract.
The parties agree that Ohio law applies to KeyBank's contract. Ohio follows the test for third-party beneficiaries set out in the Restatement (Second) of Contracts. See TRINOVA Corp. v. Pilkington Bros., P.L.C., 638 N.E.2d 572, 576-77 (Ohio 1994); Hill v. Sonitrol of Sw. Ohio, Inc., 521 N.E.2d 780, 784 (Ohio 1988). Under section 302(1)(b), "[u]nless otherwise agreed between promisor and promisee, a beneficiary, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intention of the parties and . . . the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance." As the First Circuit has observed in the context of an appeal from a Rule 12(b)(6) dismissal, the Restatement standard is "relatively hospitable to claims by those purporting to be third-party beneficiaries.'" In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489, 499 (1st Cir. 2009).
Some Ohio courts have suggested that only the contract language is relevant to determining whether a party is an intended third-party beneficiary. See In re Nat'l Century Fin. Enters., Inc., No. 08-4216, 2010 WL 1976639, at *7 (6th Cir. May 18, 2010) ("Ohio courts look to the language of the contract to determine if a party is a direct or incidental beneficiary."); Joest Vibratech, Inc. v. N. Star Steel Co., 109 F. Supp. 2d 746, 749 (N.D. Ohio 2000) ("In order to be an intended beneficiary, the 'clear terms of the contract' must show that the parties entered the contract for the benefit of the third party." (quoting Hill, 521 N.E.2d at 783)). This view appears overly restrictive. Under section 302(1)(b), "[u]nless otherwise agreed between promisor and promisee, a beneficiary, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intention of the parties and . . . the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance." The Reporter's Notes explain that a "court in determining the parties' intention should consider the circumstances surrounding the transaction as well as the actual language of the contract." Restatement (Second) of Contracts § 302, Reporter's Notes, cmt. a; see also Melvin A. Eisenberg, Third-Party Beneficiaries, 92 COLUM. L. REV. 1358, 1389-90 (1992) (noting that the Restatement (Second) of Contracts rejects formal limits on the evidence relevant to determining intent).
The Ohio Supreme Court has explicitly recognized that the "circumstances surrounding the promise" are relevant to determining whether a third party was an intended beneficiary of a contact. Anderson v. Olmsted Util. Equip., Inc., 573 N.E.2d 626, 130 n. 1 (Ohio 1988). In Anderson, the plaintiffs were two city employees injured when the arm of a "cherry picker" truck broke. The court had to determine whether the employees were third-party beneficiaries of the city's contract to repair the equipment. The court looked to the contract terms and to extrinsic evidence of the city's intent. The court first observed that the contract recited the city's intent to have the "equipment rebuilt to 100% Holan specifications and safety." Id. at 631. The court also relied on testimony. The court noted that "when questioned at trial concerning the inspection and rebuilding of the aerial device, Charles Burgess, the superintendent of the city's light department, testified that the purpose of rebuilding the aerial device was for safety of linemen who were to use the truck." Id. at 631-32. The court found that the plaintiff was a third-party beneficiary of the repair contract. The Ohio Supreme Court has not overruled Anderson.
Courts interpreting the Restatement have enforced explicit statements in a contract that no third-party rights are created. See, e.g., Maghie Savage, Inc. v. P.J. Dick Inc., No. 08APP-487, 2009 WL 1263965, at *11 (Ohio App. May 5, 2009) (citing cases). Courts have followed this approach in litigation related to data breaches similar to the events giving rise to this suit. TJX Cos., 564 F.3d at 499; Pa. State Employees Credit Union v. Fifth Third Bank, 398 F. Supp. 2d 317, 324 (M.D. Pa. 2005); Cumis Ins. Co. v. BJ's Wholesale Club, Inc., 918 N.E.2d 36, 466-69 (Mass. 2009). In those cases, the contracts explicitly addressed third-party rights. Language included in the contracts stated that they were "for the benefit of, and may be enforced by, [the parties] and their respective successors and permitted transferees and assignees, and [] not for the benefit of, and may not be enforced by, any third party." Cumis, 918 N.E.2d at 43-44. KeyBank's contract contains no similar language limiting or precluding third-party rights.
KeyBank argues that the Financial Institution Plaintiffs cannot sue on their contract with Heartland Payment Systems because that contract incorporates the Visa and MasterCard regulations disclaiming third-party rights. The contract requires Heartland Payment Systems to "comply fully with all by-laws and regulations of Visa and MasterCard." (Docket Entry No. 29, ¶ 1.1(f)). To the extent that the regulations and the contract conflict, the regulations control. ( Id., ¶ 1.1(h)).
The Visa regulations provide in relevant part as follows:
The Visa U.S.A. Inc. Operating Regulations apply only to financial institutions conducting Card issuing and Merchant acquiring activities within the U.S.A. Region as Members of Visa U.S.A. Inc., and their Agents. As such, the Operating Regulations govern the relationship between Visa U.S.A. Inc. and its Members and their Agents. The Operating Regulations do not constitute a third-party beneficiary contract as to any entity or person, nor do they constitute a contract, promise or representation, or confer any rights, privileges, or claims of any kind to any third parties.
(Docket Entry No. 28, Ex. B, ¶ 1.2C). The MasterCard regulations state that MasterCard "has the sole right in its discretion to interpret and enforce the Standards." ( Id., Ex. C, ¶ 3.1). The quoted provision of the Visa regulations expressly forbids third-party suits. The MasterCard regulations forbid third party suits because MasterCard has the "sole" right to enforce the regulations. Courts in other data breach litigation have reached the same result. TJX Cos., 564 F.3d at 499; In re TJX Cos. Retail Sec. Breach Litig., 524 F. Supp. 2d 83 (D. Mass. 2007), aff'd 546 F.3d 489 (1st Cir. 2009); PSECU, 398 F. Supp. 2d at 323-26. By incorporating the regulations into its contract with Heartland Payment Systems and making the regulations control to the extent that they conflict with any other provision of the contract, KeyBank made clear that no third party could assert third-party beneficiary status under the regulations and no third party could sue based on noncompliance with the regulations. The Visa and MasterCard regulations that limit third-party beneficiary status or third-party suits to enforce the regulations do not preclude a third party from invoking other duties in the KeyBank contract with Heartland Payment Systems. The contract, however, does not provide the duties that the Financial Institution Plaintiffs allege that KeyBank breached.
The contractual duties that the Financial Institution Plaintiffs invoke are the duties "expressly and/or require[d]" to "monitor, audit, oversee and confirm" the adequacy of Heartland Payment Systems security measures. (Docket Entry No. 1, ¶ 119). The Financial Institution Plaintiffs rely on the confidentiality provision and the references to affiliates. The confidentiality provision states:
4.3 Confidentiality
(a) KeyBank will safeguard, and hold confidential from disclosure to unauthorized persons, all data relating to the Plan submitted to KeyBank pursuant to this Agreement to the same extent that KeyBank safeguards data relating to its own business, unless such data is otherwise available to the public or is already in KeyBank possession and was rightfully obtained by it from others, or unless required by law or regulation, or by Visa or MasterCard. In such case, KeyBank will bear no responsibility for disclosures thereof or with respect thereto, whether inadvertent or otherwise. Nothing contained herein will preclude KeyBank participation in Visa and/or MasterCard fraud and/or counterfeit deterrent procedures.
(b) HPS will safeguard, and hold confidential from disclosure to unauthorized persons, all data relating to KeyBank business received by HPS pursuant to this Agreement to the same extent that HPS safeguards data relating to its own business, unless such data is otherwise available to the public or is already in HPS possession and was rightfully obtained by it from others, or unless required by law or regulation.
(Docket Entry No. 29, Ex. 29, ¶ 4.3). The contract casts the confidentiality promises as mutual promises between KeyBank and Heartland Payment Systems. KeyBank is required to protect data it receives under the contract "to the same extent that KeyBank safeguards data relating to its own business." Even if the complaint alleged that KeyBank ordinarily monitors contractors' privacy practices to a greater extent than it monitored such practices at Heartland Payment Systems, the complaint contains no allegation that KeyBank had received the credit card information allegedly breached. The complaint alleges that KeyBank hired Heartland Payment Systems to solicit merchants and to process transactions. The complaint does not allege that the credit card data that was improperly accessed had come into KeyBank's possession.
The Financial Institution Plaintiffs point to the requirement that KeyBank indemnify the Heartland Payment Systems "affiliates." The contract requires KeyBank to "indemnify, protect and hold harmless HPS and its . . . affiliates." ( Id., ¶ 4.3). "The words used in a contract are to be given their plain and ordinary meaning." Ohio Gov't Risk Mgmt. Plan v. Harrison, 874 N.E.2d 1155, 1161 (Ohio 2007) (citing Gomolka v. State Auto. Mut. Ins. Co., 436 N.E.2d 21347, 1351 (1980)). The ordinary meaning of the term "affiliate" in this context is a "corporation that is related to another corporation by shareholdings or other means of control" or "a subsidiary, parent, or sibling corporation." See BLACK'S LAW DICTIONARY 63 (8th ed. 2004). The only alleged relationship the Financial Institution Plaintiffs have to Heartland Payment Systems is through the Visa and MasterCard networks. The complaint alleges no facts suggesting that an affiliate relationship between Heartland Payment Systems and the Financial Institution Plaintiffs.
The Financial Institution Plaintiffs' breach of contract claim is dismissed. Because no prior amendment has been filed, and because there is no basis to find futility as a matter of law, it is appropriate to grant leave to amend.
D. The Breach of Fiduciary Duty Claim
The Financial Institution Plaintiffs allege that KeyBank breached its fiduciary duties. The Plaintiffs argue that the Visa and MasterCard networks are joint ventures whose members owe fiduciary duties to each other. The parties agree that whether the Visa network is a joint venture must be evaluated under New York law. The parties dispute whether New York or New Jersey law applies to the MasterCard network. But under either state's law, the allegations that the networks are joint ventures that created fiduciary duties on KeyBank are insufficient.
Under New York law, a joint venture exists when:
(1) two or more persons enter into an agreement for profit; (2) the parties intend to be associated as joint venturers; (3) each of the venturers contributes something of value to the venture, such as property, skill, knowledge or effort; (4) each co-venturer has some degree of control over the venture; and (5) the co-venturers agree to some division of profit and loss allocation.Cosy Goose Hellas v. CosyGoose USA, Ltd., 581 F. Supp. 2d 606, 620 (S.D. N.Y. 2008); see also Dinaco Inc. v. Time Warner, Inc., 346 F.3d 64, 67-68 (2d Cir. 2003); Itel Containers Int'l Corp. v. Atlanttrafik Express Serv. Ltd., 909 F.2d 698, 701 (2d Cir. 1989). "The absence of any one element is 'fatal to the establishment of a joint venture.'" Kidz Cloz, Inc. v. Officially for Kids, Inc,, 320 F. Supp. 2d 164, 171 (S.D. N.Y. 2004) (quoting Zeising v. Kelly, 152 F. Supp. 2d 335, 347-48 (S.D. N.Y. 2001)).
Both sides have cited antitrust cases considering whether Visa network members are joint venturers. For the purpose of antitrust law, "[j]oint ventures and other cooperative agreements are . . . not usually unlawful, at least not as price-fixing schemes, where the agreement on price is necessary to market the product at all." Broad. Music, Inc. v. Columbia Broad. Sys., Inc., 441 U.S. 1, 23 (1979). But a relationship of cooperation that is "not technically a 'joint venture'" may satisfy this rule. See Nat'l Bancard Corp. v. VISA U.S.A., Inc., 779 F.2d 592, 601 (11th Cir. 1996). For example, the National Bancard court observed that members of the Visa network "neither share profits and losses nor commingle management functions" and that "[e]ach member . . . competes actively against other members in a variety of ways." Id. at 601 n. 16 (citing Nat'l Bancard Corp. v. VISA U.S.A., Inc., 596 F. Supp. 1231, 1253 (S.D. Fla. 1986)). The court in Visa U.S.A., Inc. v. First Data Corp., No. C 02-01786 JSW, 2006 WL 516662 (N.D. Cal. Mar. 2, 2006), concluded that the Visa network was not a joint venture even for the purpose of an antitrust single-entity analysis. The court noted that although the members owed duties to the Visa organization, they had no fiduciary duties to each other. Id. at *3. The court also pointed out that there was no network-wide sharing of profits and losses because the "profits and losses . . . do not end up under the same corporate mattress." Id. at *4. And like the National Bancard court, the First Data court observed that members of the Visa network competed with each other. Id. at *4 n. 2 (citing cases reaching the same conclusion).
The Financial Institution Plaintiffs do not distinguish these cases. Under these cases, the complaint does not allege a joint venture with corresponding fiduciary obligations. There is no allegation that Visa or MasterCard members share profits or losses; "co-venturers [must] agree, either expressly or impliedly, to share liability for the possible obligations, debts, and losses of the joint venture itself." Cosy Goose Hellas, 581 F. Supp. 2d at 622; Kidz Cloz, 320 F. Supp. 2d at 171-72, 175 (summarizing case law and holding that the absence of a discussion of sharing losses resulted in the absence of an "indispensable" element of a joint venture); Weinreich v. Sandhaus, No. 83 CIV. 3966 (CES), 1989 WL 130641 at *4 (S.D. N.Y. July 24, 1989) ("the sharing of liability for the actions of one another in the conduct of a partnership or joint venture goes to the core of the fiduciary obligations established by such a relationship.").
The Financial Institution Plaintiffs rely on the following allegation in their complaint:
In a Visa or MasterCard Payment Card purchase, the merchant actually receives approximately 98% of the price of the good or service sold. The remaining 2%, known as a "merchant discount," is the fee paid to the merchant's Acquirer bank for providing the Payment Card processing services. The Acquirer, in turn, splits the fee with the Payment Card issuer which receives approximately 1.4% of the purchase price. The Issuer receives the majority of the fee because it owns the consumer's account and assumes the risk of non-payment. The 1.4% of the fee paid to the Issuer is called the "interchange fee."
(Docket Entry No. 1, ¶ 34). Even if this allegation is broadly read to include a sharing of profits, it cannot be read to include a sharing of losses. Indeed, the complaint goes on to suggest that the members of the Visa and MasterCard networks bear no risk of shared loss. "The Visa and MasterCard Associations are supported primarily by service and transaction fees paid by their members (such as Plaintiffs and Defendants). Visa and MasterCard set their fees to cover the costs involved in providing the basic infrastructure to the members, but do not charge license fees or royalties to their members." ( Id., ¶ 35). The complaint specifies that it is the issuers who bear the risk of cardholders' nonpayment and the acquirer banks who bear the risk of charge-backs. ( Id., ¶¶ 34, 42).
The Financial Institution Plaintiffs contend that New Jersey law is more lenient, requiring only profit sharing for a joint venture to exist. The defendants argue that New Jersey law does not apply. Even if New Jersey law applies, however, the complaint's allegations are insufficient. Numerous courts interpreting New Jersey law have required sharing losses as well as profits. Kocher v. UC Overlook Dev., LLC, No. L-1828-07, 2010 WL 1655906, at *9 (N.J. Super. Ct. App. Div. Apr. 22, 2010); Ginsberg v. Bistricer, No. C-113-98, 2007 WL 987169, at *11 (N.J. Super. App. Div. Apr. 4, 2007); Am. Fire Cas. Ins. Co. v. Manzo, 788 A.2d 925, 929 (N.J. Super. App. Div. 2002); Fliegel v. Sheeran, 640 A.2d 852, 854 (N.J. Super. App. Div. 1994); Kozlowski v. Kozlowski, 395 A.2d 913, 917 (N.J. Super. Ct. Ch. Div. 1978); Wittner v. Metzger, 178 A.2d 671, 675 (N.J. Super. App. Div. 1962). In Grober v. Kahn, the New Jersey Supreme Court found that an agreement to hold property jointly was not a joint venture in part because the parties did not agree to share losses. 219 A.2d 601, 608 (N.J. 1966).
The Financial Institution Plaintiffs rely on National State Bank of Newark v. Terminal Construction Corp., 217 F. Supp. 341 (D. N.J. 1963). The court quoted Wittner, cited above, in defining a joint venture as a "special combination of two or more persons where in some specific venture a profit is jointly sought without any actual partnership or corporate designation." 217 F. Supp. at 351-52 (quoting Wittner, 178 A.2d at 674-76). In the same sentence, however, the court noted the requirement that "the parties agree to share profits and losses." Id. (quoting Wittner, 178 A.2d at 674-76). New Jersey law requires that joint venturers share losses as well as profits. The Financial Institution Plaintiffs have not alleged shared losses.
KeyBank also argues that the economic loss rule prevents recovery on the breach of fiduciary duty claim. Several court have held that the economic loss rule does not apply to claims for breach of fiduciary duty. See, e.g., In re Gosnell Dev. Corp. of Ariz., 331 F. App'x 440, 441-42 (9th Cir. 2009) (per curiam) (unpublished) (explaining that physical harm is "neither required nor expected" to flow from a breach of fiduciary and that the duty exists in areas where "bargaining and risk allocation" are insufficient safeguards); Bohler-Uddeholm Am., Inc. v. Ellwood Grp., Inc., 247 F.3d 79, 104 n. 11 (3d Cir. 2001) (concluding that the economic-loss rule "does not quite fit" a fiduciary duty claim); United Int'l Holdings, Inc. v. Wharf (Holdings) Ltd., 210 F.3d 1207, 1226-27 (10th Cir. 2000) (reasoning that the "fiduciary duty claim arose not from the contract but from the parties' status as joint venturers"); Invo Fla., Inc. v. Somerset Venturer, Inc., 751 So. 2d 1263, 1266-67 (Fla. Dist. Ct. App. 2000) (explaining that the economic-loss rule, developed in the context of products liability, was never intended to displace well-established torts, such as breach of fiduciary duty); Town of Alma v. AZCO Constr., Inc., 10 P.3d 1256, 1262-63 (Colo. 2000) ("[S]ome torts are expressly designed to remedy pure economic loss. . . ."). Courts in New Jersey have recognized that "breach of the fiduciary's duty normally generates only economic loss." See, e.g., Bondi v. Citigroup, Inc., No. BER-L-10902-04, 2005 WL 975856, at *18 (N.J. Super. Ct. Law Div. Feb. 28, 2005). Courts in New York have agreed. See, e.g., Guilderland Reins. Co v. Gold, 642 N.Y.S.2d 99, 99-100 (N.Y. App. Div. 1996) (reversing dismissal of a fiduciary duty claim on economic-loss grounds); The Limited, Inc. v. McCrory Corp., 169 A.2d 605, 607-08 (N.Y. App. Div. 1991) ("[T]he 'economic loss' rule does not extend to prohibiting a suit by a party in privity for pecuniary losses suffered as a result of breach of a duty independent of the contract."). KeyBank's reliance on an Ohio case that held with little analysis that the economic-loss rule barred a fiduciary duty claim, see OC Prop. Mgmt., L.L.C. v. Gerner Kerans Co., No. 90736, 2008 WL 4263563, at *2 (Ohio App. Sept. 18, 2008), is not persuasive.
The Financial Institution Plaintiffs' fiduciary duty claim is dismissed. Because the complaint has not been previously amended, and because the record does not permit the conclusion that, as a matter of law, any amendment would be futile, the dismissal is with leave to amend.
E. The Negligence Claim
The Financial Institution Plaintiffs allege that KeyBank negligently failed to ensure that the Heartland Payment Systems security procedures were sufficient to protect the financial data it received. The defendants argue that the economic loss rule prevents the Financial Institution Plaintiffs from recovering on a negligence claim. Under the laws of Ohio and Texas, which, according KeyBank, are the only two jurisdictions whose law could apply, economic losses with no personal or property injury do not give rise to a duty in tort. Instead, when the economic loss is to the subject of a contract itself, the action sounds in contract, not in tort. See Memorial Hermann Healthcare Sys., Inc. v. Eurocopter Deutschland, GMBH, 524 F.3d 676, 678 (5th Cir. 2008) (summary calendar) (citing Hou-Tex, Inc. v. Landmark Graphics, 26 S.W.3d 103, 107 (Tex. App. — Houston [14th Dist.] 2000, no pet.); Sagraves v. Lab One, Inc., 316 F. App'x 366, 369 (6th Cir. 2008) (unpublished) (citing Chemtrol Adhesives, Inc. v. Am. Mfrs. Mut. Ins. Co., 537 N.E.2d 624, 630-31 (Ohio 1989)). The defendants note that courts examining claims arising from data breaches have held that the economic loss rule bars tort damages arising from such breaches. TJX Cos., 564 F.3d 498-99; Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162, 179-80 (3d Cir. 2008); Cumis, 918 N.E.2d at 469-71; PSECU, 398 F. Supp. 2d at 326.
The Financial Institution Plaintiffs do not dispute that Texas and Ohio law preclude tort recovery for economic losses. Instead, the Financial Institution Plaintiffs contend that New Jersey law should apply, because the Heartland Payment Systems headquarters is in Princeton, New Jersey. "The New Jersey Supreme Court has long been a leader in expanding tort liability." Hakimoglu v. Trump Taj Mahal Assocs., 70 F.3d 291, 295 (3d Cir. 1995). Unlike Ohio and Texas, New Jersey allows tort recovery for economic losses under some circumstances. Paramount Aviation Corp. v. Agusta, 288 F.3d 67, 76-77 (3d Cir. 2002) (citing People Express Airlines, Inc. v. Consolidated Rail Corp., 495 A.2d 107, 116 (N.J. 1985)). The Financial Institution Plaintiffs contend that it is inappropriate to resolve a choice-of-law issue in the context of a motion to dismiss because the determination of which law applies involves the fact-intensive question of which state has the most significant relationship to this case. The Financial Institution Plaintiffs urge this court either to refuse to entertain the motion to dismiss because deciding the choice-of-law issue is premature, see, e.g., In re K-Dur Antitrust Litig., 338 F. Supp. 2d 517, 541 (D. N.J. 2004) (declining to settle substantive issues at class certification when the choice of law was unclear), or to consider the motion under New Jersey law, see, e.g., Nakell v. Liner Yankelevitz Sunshine Regenstreif, LLP, 394 F. Supp. 2d 762, 768 (M.D. N.C. 2005). The defendants respond that the complaint allegations are insufficient to state a claim under New Jersey law, both because the facts alleged do not suggest that New Jersey law could apply, see Berry v. Indianapolis Life Ins. Co., 608 F. Supp. 2d 785, 800 n. 16 (N.D. Tex. 2009) (dismissing a complaint containing insufficient facts determine which law should apply under Rule 12(b)(6)) (citing Enigma Holdings v. Gemplus Int'l, S.A., No. 3:05-cv-01168-B, 2006 WL 2859369, at *7 (N.D. Tex. Oct. 6, 2006)), and because New Jersey does not recognize a tort duty in the circumstances presented by this case.
Under Texas choice-of-law rules, it is unnecessary to choose which state's law applies if there is no conflict between them. Sonat Exploration Co. v. Cudd Pressure Control, Inc., 271 S.W.3d 228, 231 (Tex. 2008). As explained below, the economic loss rule applies in this case under New Jersey law, the same result that would be reached under Texas and Ohio law. There is no need to settle the choice-of-law issue.
New Jersey does not prevent tort recovery for purely economic losses in every case. In People Express Airlines, Inc. v. Consolidated Rail Corp., the New Jersey Supreme Court held that there was a duty "to take reasonable measures to avoid the risk of causing economic damages, aside from physical injury, to particular plaintiffs or plaintiffs comprising an identifiable class with respect to whom defendant knows or has reason to know are likely to suffer such damages from its conduct" under the facts of that case. 495 A.2d at 116. Whether the duty exists depends in part on the foreseeability of such damages to a particular plaintiff or class of plaintiffs. "The more particular is the foreseeability that economic loss will be suffered by the plaintiff as the result of the defendant's negligence, the more just is it that liability be imposed and recovery allowed." Id. To be an "identifiable class," the "class of plaintiffs must be particularly foreseeable in terms of the type of persons or entities comprising the class, the certainty or predictability of their presence, the approximate numbers of those in the class, as well as the type of economic expectations disrupted." The test recognizes a "spectrum [of foreseeability] ranging from the general to the particular," id. at 115, allowing a court to "limit otherwise boundless liability and define an identifiable class of plaintiffs that may recover. Id.
In People Express, the plaintiff airline sued the rail company for business-interruption damages after a volatile chemical caught fire in a rail yard adjacent to the airport in Newark, New Jersey. Id. at 108. An evacuation of a one-mile radius closed the airport's northern terminal for twelve hours. Id. The northern terminal housed the airline's business operations. Id. During the evacuation, the airline had to cancel flights and its employees were unable to book flights for customers. Id. The court identified the proximity of the north terminal to the accident; the "obvious nature" of People Express's presence and operations that made economic harm foreseeable; evidence that the defendants knew of the chemical's volatility, and an emergency response plan established with the input of some of the defendants that called for evacuation of the terminal. Id. at 118. The court distinguished drivers on a nearby highway whom the fire delayed. The drivers were a foreseeable, but not an identifiable, class. The presence of any particular driver — and therefore of injury of that driver — was merely fortuitous. Id. at 116.
At the pleading stage, the Financial Institution Plaintiffs' allegations satisfy the People Express foreseeability test. The complaint sets forth, in significant detail, the contractual relationships that hold together the Visa and MasterCard networks. The financial institutions participating are identifiable, and the kinds of damages alleged — stemming primarily from card replacement and charging off fraudulent transactions — are straightforward. The complaint also suggests that the defendants should have been aware of the possibility of a "hacker." Previous similar breaches of other systems were highly publicized. (Docket Entry No. 1, ¶ 67). Meeting the foreseeability test under People Express is necessary but not sufficient under New Jersey Law. See, e.g., Carvalho v. Toll Bros. Developers, 675 A.2d 209, 573 (N.J. 1996); Carter Lincoln-Mercury, Inc., Leasing Div. v. EMAR Grp., Inc., 638 A.2d 1288, 1294 (N.J. 1994).
"New Jersey courts have consistently held that contract law is better suited to resolve disputes where a plaintiff alleges direct and consequential losses that were within the contemplation of sophisticated business entities that could have been the subject of their negotiations." Travelers Indem. Co. v. Dammann Co., 594 F.3d 238, 248 (3d Cir. 2010). Many of these cases have arisen in the context of tort claims for defective products resulting in economic losses, not faulty provision of services resulting in such losses. Contracts for the sale of goods, unlike contracts for services, are subject to New Jersey's enactment of the Uniform Commercial Code. See N.J. STAT. § 12A:2-102 ("Unless the context otherwise requires, this Chapter applies only to transactions in goods. . . ."). In two decisions refusing to allow common-law tort actions, one before People Express and one after, the New Jersey Supreme Court held that the legislatively enacted U.C.C. provided a "comprehensive system for determining the rights and duties of buyers and sellers with respect to contracts for the sale of goods" and displaced tort remedies for economic losses from defective products. Spring Motors Distribs., Inc. v. Ford Motor Co., 489 A.2d 660, 665 (1985); see also Alloway v. Gen. Marine Indus., 695 A.2d 264, 267-68 (1997). As the Third Circuit observed, " Spring Motors and Alloway reflect a deference to legislative will where the legislature has provided a comprehensive scheme controlling the relationship between the parties and, more specifically, a recognition of the allocation of risk against the background of the rights and remedies provided by the U.C.C." Dammann, 594 F.3d at 248 (quoting Paramount, 288 F.3d at 73).
In the services context, "relationships created by contract can give rise to affirmative duties imposed by law." Saltiel v. GSI Consultants, Inc., 788 A.2d 268, 277 (N.J. 2002). Doctors and lawyers, for example, owe common-law duties of care to their clients, regardless of the terms of their contracts. Id. at 280. Spring Motors and Alloway make clear, however, that it is inappropriate to create tort duties between sophisticated businesses that allocate risks through contract. Spring Motors rejected strict liability in sales alongside the U.C.C. in part because "considerations that give rise to strict liability do not obtain between commercial parties with comparable bargaining power" and observed that a "commercial buyer . . . may be better situated than the manufacturer to factor into its price the risk of economic loss caused by the purchase of a defective product." 489 A.2d at 670-71. "[B]etween commercial parties, . . . allocation of risks in accordance with their agreement better serves the public interest than an allocation achieved as a matter of policy without reference to that agreement." Id. When the parties agree to how risk should be allocated, "society has an interest in seeing that the agreement is fulfilled." Id. at 668; see also id. at 670 (noting the importance of "the relative bargaining power of the parties and the allocation of the loss to the better risk-bearer in a modern marketing system"); accord Alloway, 695 A.2d at 268. The Third Circuit concluded that the New Jersey cases represented a "clear rejection of an approach that would allow tort law in cases involving sophisticated parties with equal bargaining power." Dammann, 594 F.3d at 251; see also In re Merritt Logan, Inc., 901 F.2d 349, 362 (3d Cir. 1990) (" People Express simply does not address or concern the rule established in Spring Motors.").
Numerous courts have held that the economic loss doctrine applies to preclude tort suits for such losses resulting from contracts for services under New Jersey law. "While the [economic loss doctrine] has been predominantly applied in connection with transactions for goods, it has also been found, in New Jersey, to apply to contracts for services." Titan Stone, Tile Masonry, Inc. v. Hunt Constr. Grp., Inc., Civ. A. No. 05-cv-3362 (GEB), 2007 WL 174710, at *4 (D. N.J. Jan. 22, 2007) (citations omitted); accord State Capital Title Abstract Co. v. Pappas Bus. Servs., LLC, 646 F. Supp. 2d 668, 767-678 (D. N.J. 2009) (dismissing claims against a title search company under Rule 12(b)(6)); CapitalPlus Equity, LLC v. Prismatic Dev. Corp., Civ. A. No. 07-321 (WHW), 2008 WL 2783339, at *6 (D. N.J. July 16, 2008) ("Contrary to plaintiff's contention, the economic loss doctrine has been applied not only in products liability cases, but also in actions arising out of contracts for services. . . ."); Bracco Diagnostics Inc. v. Bergen Brunswig Drug Co., 226 F. Supp. 2d 557, 562-65 (D. N.J. 2002) (dismissing fraud claims arising out of the performance of a contract under Rule 12(b)(6) and distinguishing cases involving fraudulent inducement); Dynalectric Co. v. Westinghouse Elec. Corp., 803 F. Supp. 985, 991-93 (D. N.J. 1992) (distinguishing People Express); Healthcare Servs., Inc. v. Nat'l Prescription Adm'rs, Inc., 867 F. Supp. 1223, 1229 (E.D. Pa. 1994) (refusing to allow negligence claim for damages arising out of negligent claims processing). People Express addresses situations in which the parties have no contractual relationship, whereas Spring Motors generally controls when the relationship arise out of contract. See Healthcare Servs., 867 F. Supp. at 1229.
The Financial Institution plaintiffs contend that it is premature to determine whether a duty exists under New Jersey law, because the existence of a duty depends on the specific facts at issue. See Wang v. Allstate Ins. Co., 592 A.2d 527, 534, (N.J. 1991) ("Of course, the legal determination of the existence of a duty may differ, depending on the facts of he case."); J.S. v. R.T.H., 693 A.2d 1191, 1193 (N.J. Super. Ct. App. Div. 1997) ("The facts of a case inform the court in determining whether a duty exists."). But when it is clear that the economic loss rule prevents recovery based on the alleged facts, a court should dismiss the case. See Dammann, 594 F.3d at 259 (affirming the district court's denial of leave to amend as futile); State Capital Title, 646 F. Supp. 2d at 677-78, 682 (dismissing under Rule 12(b)(6) based on the economic loss rule); Titan Stone, 2007 WL 174710, at *6 (same); Bracco Diagnostics, 226 F. Supp. 2d at 562-65 (same).
In this suit, the Financial Institution Plaintiffs are trying to do precisely what New Jersey law precludes. Issuers, such as the Financial Institution Plaintiffs, and acquirers, such as KeyBank, are bound through their contracts with Visa and MasterCard. The networks have their own rules and regulations, including rules requiring acquirer banks that contract out their duties to impose the network regulations on the contractors. When KeyBank hired Heartland Payment Systems to find customers and process transactions, it bound the company to those regulations. The Visa and MasterCard regulations provide dispute-resolution and compensation rules when data breaches result in losses to issuers. The contractual obligations and compensation system, not tort law, are the Financial Institution Plaintiffs' only means of seeking compensation for economic losses.
This conclusion is consistent with the Third Circuit's application of New Jersey law. In Dammann, the court explained that when making an Erie guess, the court should "opt for the interpretation that restricts liability, rather than expands it, until the Supreme Court of New Jersey decides differently." 594 F.3d at 253 (quoting Werwinski v. Ford Motor Co., 286 F.3d 661, 680 (3d Cir. 2002)) (brackets omitted); see also id. at 253 n. 10 (observing that the approach is appropriate "in any case in which a federal court sits in diversity"). "To the extent our conclusion enlarges the scope of contract liability at the expense of tort liability," the court noted, "we believe that approach to be consonant with New Jersey law." Id. at 253.
The negligence claims is dismissed with prejudice and without leave to amend because amendment would be futile under the applicable law.
F. Vicarious Liability
The Financial Institution Plaintiffs claim that the KeyBank is vicariously liable for the negligence of Heartland Payment Systems. The relationships among issuers, acquirers, and their contractors — such as Heartland Payment Systems — are governed by the Visa and MasterCard regulations. Heartland Payment Systems owed no tort duty to prevent the Financial Institution Plaintiffs' economic losses. The claim for vicarious liability for a breach of that duty fails. See, e.g., Flannery v. Mid Penn Bank, No. 1:CV-08-0685, 2008 WL 5113437, at *7 n. 6 (M.D. Pa. Dec. 3, 2008); City of Southaven v. Datamatic, Ltd., No. 2:07-cv-58, 2008 WL: 3200706, at *1 (N.D. Miss. Aug. 6, 2008); Anastasi Bros. Corp. v. Mass. Convention Ctr. Auth., No. 890867B, 1993 WL 818553, at *3 (Mass. Super. Ct. Nov. 1, 1993); cf. McFadden v. Turner, 388 A.2d 244, 246 (N.J. Super. Ct. App. Div. 1978) (stating that claim and issue preclusion prevents a plaintiff from suing the principal for vicarious liability after suing the agent on the primary duty and losing).
IV. Conclusion
Heartland Bank's motion to dismiss for lack of personal jurisdiction is granted. KeyBank's motion to dismiss for failure to state a claim under Rule 12(b)(6) is granted, with prejudice as to the negligence claim and without prejudice as to the remaining claims. A status conference is set for April 18, 2011, at 8:45 a.m.
SIGNED on March 31, 2011, at Houston, Texas.