In data breach case, Fifth Circuit says New Jersey’s economic loss doctrine does not bar negligence claim by credit card issuers

By Stephen J. Shapiro

In 2008, hackers compromised the network of Heartland Payment Systems, a company that processes credit card transactions, and obtained access to the personal data of millions of credit card holders. Not surprisingly, the incident led to a slew of litigation, including a lawsuit filed in federal court in Texas by several banks that had issued credit cards to customers whose personal data was exposed by the breach. These “issuer banks” alleged that, because of the breach, they incurred significant costs replacing the credit cards of impacted customers and refunding fraudulent charges.

The trial court dismissed the issuer banks’ negligence claim against Heartland on the ground that it was barred by New Jersey’s economic loss doctrine (the issuer banks alleged that New Jersey law governed), which, as a general proposition, bars negligence and other tort claims when the alleged damages are purely economic and instead limits plaintiffs to pursuing whatever contractual remedies are available to them. The trial court held that, even though the issuer banks had not contracted with Heartland, they had entered into contracts with Visa and MasterCard and, therefore, were limited to pursuing whatever remedies were available under those contracts.

The Fifth Circuit reversed in Lone Star National Bank, N.A. v. Heartland Payment Systems, Inc.  The Court first acknowledged that, as a general rule, New Jersey recognizes the economic loss doctrine. However, the Court went on to explain that the New Jersey courts have developed a multi-faceted exception to the doctrine. Specifically, the doctrine does not bar negligence and other tort claims where the defendant knows or has reason to know that an identifiable class of plaintiffs are likely to suffer economic damage as a result of its conduct.

An “identifiable class” of plaintiffs is one that is “particularly foreseeable in terms of the type of persons or entities comprising the class, the certainty or predictability of their presence, the approximate numbers of those in the class, as well as the type of economic expectations disrupted.” An identifiable class also must be sufficiently narrow to “circumscribe a defendant’s orbit of duty [and] limit otherwise boundless liability.” In addition, courts in New Jersey have declined to apply the economic loss doctrine where doing so would leave a plaintiff with no remedy, either because the plaintiff did not contract with the defendant at all or because the contract between the parties does not provide the plaintiff with a remedy due to the defendant’s superior bargaining power.

Applying the exception to the economic loss doctrine to the case before it, the Fifth Circuit first held that the issuer banks were an identifiable class of plaintiffs because: (1) Heartland could foresee that its failure to prevent a data breach would cause the issuer banks to suffer economic losses; (2) the identity and number of issuer banks that would be impacted by Heartland’s conduct is easy to ascertain, since Heartland sent credit card transaction information to them on a regular basis; and (3) Heartland would not be exposed to “boundless liability” if the small group of issuer banks are permitted to pursue tort claims against the company.

In addition, the Court noted that, on the limited record before it, the issuer banks appeared to have no remedy for the damages caused by Heartland’s alleged negligence under their contracts with Visa and MasterCard and that the issuer banks would not have had the bargaining power to negotiate risk allocation provisions with Visa and MasterCard had they attempted to do so. Therefore, the Court concluded that New Jersey’s economic loss doctrine does not bar the issuer banks’ negligence claim against Heartland, and remanded the case for further proceedings.

Comments are closed.

%d bloggers like this: