Banknorth, N.A. v. Bj's Wholesale Club, Inc.

• Decision Date: 13 April 2006
• Docket Number: Civil No. 1:CV-05-1801.
• Citation: 442 F.Supp.2d 206
• Parties: BANKNORTH, N.A., Plaintiff v. BJ'S WHOLESALE CLUB, INC. and Fifth Third Bank, Defendants BJ's Wholesale Club, Inc., Third-Party Plaintiff, v. International Business Machines Corporation, Third-Party Defendant.
• Court: U.S. District Court — Middle District of Pennsylvania

442 F.Supp.2d 206

BANKNORTH, N.A., Plaintiff v. BJ'S WHOLESALE CLUB, INC. and Fifth Third Bank, Defendants BJ's Wholesale Club, Inc., Third-Party Plaintiff, v. International Business Machines Corporation, Third-Party Defendant.

Civil No. 1:CV-05-1801.

United States District Court, M.D. Pennsylvania.

April 13, 2006.

Devin J. Chwastyk, Donald B. Kaufman, McNees Wallace & Nurick LLC, Harrisburg, PA, for Plaintiff.

Christopher A. Lewis, Richard L. Kremnick, Blank Rome Comisky & McCauley LLP, Philadelphia, PA, Andrew L. Swope, Kirkpatrick & Lockhart LLP, Harrisburg, PA, Christopher C. Taintor, Mark G. Lavoie, Norman, Hanson & Detroy, Portland, ME, Elizabeth E.W. Weinewuth, William Breck Weigel, Vorys, Sater, Seymour & Pease LLP, Cincinnati, OH, for Defendants.

Jennifer L. Carpenter, Wilmer Cutler Pickering Hale and Dorr LLP, Boston, MA, Mark L. Rhoades, Blank Rome LLP, Philadelphia, PA, for Defendants/Third Party Plaintiff.

Robert N. Feltoon, Conrad, O'Brien, Gellman & Rohn, PC, Philadelphia, PA, for Third Party Defendant.

MEMORANDUM

CALDWELL, District Judge.

I. Introduction.

Plaintiff, Banknorth, N.A., filed this lawsuit against defendants, BJ's Wholesale Club, Inc., and Fifth Third Bank, after third parties allegedly hacked into a computer file maintained by BJ's and obtained Visa debit-card numbers of Banknorth customers. Banknorth incurred expenses for the cost of issuing new debit cards to replace the ones that had been compromised by the theft and for the cost of reimbursing those cardholders who had suffered unauthorized charges to their accounts.

Plaintiff seeks recovery of $186,000 it spent to issue new debit cards and $583,000 to cover unauthorized charges to customer's accounts. The lawsuit makes three claims against each defendant: breach of contract, negligence and equitable subrogation. Banknorth is a Maine bank and filed this case in the United States District Court for the District of Maine, but the case was transferred here on motion of the defendants since there are two other cases pending here against BJ's and Fifth Third that make similar claims arising from similar circumstances, Sovereign Bank v. BJ's Wholesale Club Inc., 395 F.Supp.2d 183 (M.D.Pa.2005), and Pennsylvania State Employees Credit Union v. Fifth Third Bank, 398 F.Supp.2d 317 (M.D.Pa.2005)("PSECU").

We are considering BJ's motion for summary judgment, which argues the following. First, the contract claim against it fails because it is based on Banknorth's status as a third-party beneficiary of BJ's contract with Fifth Third and of an alleged contract between BJ's and Visa, but the former contract disclaims any third-party-beneficiary rights, and the latter contract does not exist. Second, the economic loss rule bars the negligence claim because Banknorth seeks damages only for economic losses, not for damages to persons or property. Third, the equitable subrogation claim (which seeks recovery for customer reimbursements) fails because Banknorth was paying on its own obligation, not that of its customers.

II. Standard of Review.

On a summary judgment motion under Fed.R.Civ.P. 56, the moving party, defendant BJ's, has the initial burden of showing that Plaintiff cannot establish one or more of the essential elements of its claims. See Hugh v. Butler County Family YMCA, 418 F.3d 265, 267 (3d Cir.2005). Plaintiff as the nonmoving party cannot rest upon the allegations of its pleadings but must present specific facts showing a genuine issue for trial. Id. In ruling on the motion, the court must determine if there are any genuine issues of material fact that would allow a reasonable jury to find for the nonmoving party. See Debiec v. Cabot Corp., 352 F.3d 117, 128 n. 3 (3d Cir.2003). The court must also view the record, and any inferences to be drawn from it, in the light most favorable to the nonmoving party. Id. With this standard in mind, the following is the record for summary-judgment purposes.

III. Background.

"Visa U.S.A. . . . is a privately-held for profit association that supplies and supports Visa credit and debit cards issued by financial institutions to its customers . " (Compl.¶ 8.) Banknorth is a national bank with its principal place of business in Portland, Maine, (id. ¶ 1), and issues debit cards to its customers, including Visa debit cards. (Id. ¶ 7.) It is an "Issuing Bank" within the Visa system. (Id. ¶ 9.)

BJ's, with its principal place of business in Natick, Massachusetts, is a retailer which does business in Maine. (Id. ¶ 2.) It accepts Visa cards for payment of goods and services and is a "Merchant" within the Visa system. (Id. ¶ 10.)

Fifth Third is a bank with its principal place of business in Cincinnati, Ohio. (Id. ¶ 3.) It is the "Acquiring Bank" for BJ's. (Id.) An "Acquiring Bank" within the Visa system "helps the merchant fulfill Visa card payments from customers by providing authorization for card transactions, crediting the merchant's account, and then submitting the transaction to the Issuing Bank for settlement." (Id. ¶ 11.)

Acquiring Banks and Merchants have to abide by "Visa Operating Regulations" in regard to the use and processing of Visa credit and debit cards. (Id. ¶¶ 16, 18 and 24.) The regulations "prohibit Fifth Third Bank from allowing BJ's to disclose Visa account information, transaction information, or other cardholder information to third parties." (Id. ¶ 21.) They also require Fifth Third as the acquiring bank to ensure BJ's compliance with the regulations. (Id. ¶ 18.) Fifth Third's relationship with BJ's as its acquiring bank is contractual, embodied in a Merchant Agreement, and requires BJ's to comply with the Operating Regulations. (Id. ¶ 19.) The Merchant Agreement also provides that it is "for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." (Doc. 16, Ex. A, penalty-of-perjury declaration of BJ's controller, Christina M. Neppl, Tab 1, ¶ 16).

Fifth Third has a contract with Visa which requires Fifth Third to guarantee: (1) BJ's will comply with the Visa Operating Regulations; (2) "BJ's will properly secure magnetic stripe information"; (3) "BJ's will not retain magnetic stripe information after a transaction"; and (4) "BJ's will not disclose such information to unauthorized third parties." (Compl. ¶ 23.) The regulations prohibit "BJ's from disclosing any Visa cardholder account numbers, magnetic stripe information, or transaction information to unauthorized third parties," (id. ¶ 25), "from retaining or storing any Visa card magnetic stripe information after the authorization of a credit card transaction," (id. ¶ 26), and require it "to properly secure and protect Visa cardholder information and magnetic stripe data from unauthorized disclosure or access." (Id. ¶ 27.)

"BJ's did not have any contractual relationship with Visa between July 1, 2003 and February 29, 2004 that related, in any way, to the security of consumer credit or debit card transactions." (Doc. 16, Ex. A, ¶ 4, Neppl's penalty-of-perjury declaration).¹

Banknorth guarantees its customers under the "Visa Zero Liability Policy" that they will not be responsible for fraudulent purchases on their debit cards. The policy advises cardholders: "If the card is lost or stolen and used fraudulently, you are not liable for purchases made online or at merchants." (Doc. 16, Ex. A, Tab 3). Visa advises cardholders that its zero liability policy "covers all Visa credit and debit card transactions processed over the Visa network—online or off." (Id., Ex. A, Tab 3). The Visa Operating Regulations also provide:

Limitation of Cardholder Liability

A member that issues Visa Cards must comply with this section.

Upon receipt of notification from its Cardholder of unauthorized Visa Transactions, an Issuer must limit the Cardholder's liability for those Transactions to $0.

(Doc. 34, Ex. B, Visa Operating Regulations, § 3.2.G.2a).²

For its breach-of-contract claim against BJ's, Banknorth alleges it was an intended third-party beneficiary of a contract between BJ's (as a Merchant) and Visa for the processing of Visa card transactions (id. ¶ 48), and an intended third-party beneficiary of the contract between Fifth Third, as the Acquiring Bank, and BJ's as the Merchant, for processing Visa card transactions. (Id. ¶ 49.) Plaintiff alleges BJ's breached both these contracts by retaining the magnetic-stripe information for its cardholders, by not securing the information and by allowing unauthorized third parties to access the information. As a result, Plaintiff incurred the cost of cancelling and reissuing Visa debit cards for its customers, about $186,000, and the cost of reimbursing these customers for fraudulent transactions, about $583,000. (Id. ¶¶ 50, 52 and 53.) Plaintiff seeks recovery of those amounts.

For its negligence claim against BJ's, Banknorth alleges BJ's had a duty to Banknorth to comply with the regulations, particularly the obligation to secure and protect the cardholder information and not to retain or store it after a transaction, that BJ's breached its duty of care to Banknorth by retaining the information and failing to protect it for about eight months, from July 1, 2003, to February 29, 2004, (Compl. ¶¶ 30-32, 34; ¶¶ 60-61), that, as a result, unauthorized third parties obtained the magnetic-stripe information from Visa debit cards owned by Banknorth customers from BJ's electronic records, (id. ¶ 35), and that the third parties used the information for fraudulent purposes, (id. ¶ 37), causing Plaintiff to incur the costs of cancelling and reissuing Visa debit cards for its customers. (Id. ¶ 63.)

For its equitable subrogation claim against BJ's, Plaintiff alleges that BJ's breach of its duties to protect Visa card customers' magnetic-stripe information caused Banknorth to incur the costs of reimbursing its affected debit-card...