Greenstate Credit Union v. Hy-Vee, Inc.

• Decision Date: 19 July 2021
• Docket Number: CIVIL NO. 20-621(DSD/DTS)
• Citation: 549 F.Supp.3d 969
• Parties: GREENSTATE CREDIT UNION on Behalf of Itself and All Others Similarly Situated, Plaintiff, v. HY-VEE, INC., Defendant.
• Court: U.S. District Court — District of Minnesota

549 F.Supp.3d 969

GREENSTATE CREDIT UNION on Behalf of Itself and All Others Similarly Situated, Plaintiff,

v.HY-VEE, INC., Defendant.

CIVIL NO. 20-621(DSD/DTS)

United States District Court, D. Minnesota.

Signed July 19, 2021

Kate M. Baxter-Kauf, Esq. and Lockridge Grindal Nauen PLLP, 100 Washington Avenue South, Suite 2200, Minneapolis, MN 55401, counsel for plaintiff.

Paul G. Karlsgodt, Esq. and Baker & Hostetler LLP, 1801 California Street, Suite 4400, Denver, CO 80202, counsel for defendant.

ORDER

David S. Doty, Judge The matter is before the court upon defendant Hy-Vee, Inc.’s motion to dismiss. Based on a review of the file, record, and proceedings herein, and for the following reasons, the court grants the motion.

BACKGROUND

This class action dispute arises out of Hy-Vee's handling of a data breach that exposed consumers’ credit card data. Plaintiff GreenState Federal Credit Union is a federally chartered credit union with its principal place of business in Iowa. Compl. ¶ 7. Hy-Vee is incorporated in Iowa and has its principal place of business in Iowa. Id. ¶ 12. Hy-Vee operates supermarkets, convenience stores, and gas stations, with 240 retail stores in eight states, including Minnesota. Id. ¶ 13.

GreenState has twenty-six branch locations, all located in Iowa. Courtney Decl. ¶ 2; ECF No. 55, at 3. GreenState membership is open to: (1) individuals living and working in Iowa, as well as some counties in Illinois or Wisconsin that border Iowa; (2) University of Iowa students, staff, and alumni; and (3) direct relatives of current members. Id. ¶¶ 3-5; ECF No. 55, at 3. 1,158 of approximately 210,000 members - about one-half of one percent - have Minnesota addresses. Id. ¶ 7; ECF No. 55, at 3.

Thirty-eight of Hy-Vee's 264 stores are in Minnesota. Tingley Decl. ¶¶ 1, 3; ECF No. 55, at 3. 12.38% of Hy-Vee's revenue comes from Minnesota, and 13.77% of Hy-Vee's employees work in Minnesota. Id. ¶ 3; ECF No. 55, at 4. Hy-Vee's information technology department, chief technology officer, and information security team operate in Iowa. Id. ¶¶ 7-8; ECF No. 55, at 4. They are responsible for decisions regarding Hy-Vee's data and information security policy and practices, all of which are made in Iowa. Id. ¶¶ 6-10; ECF No. 55, at 4.

In payment card transactions, there are four primary parties: the merchant, the acquiring bank, the card network, and the card issuer. Compl. ¶¶ 19-20. In this context, Hy-Vee is a merchant that requests authorization of the transaction from the card's issuer. Id. An acquiring bank contracts with the merchant to process the transaction. Id. ¶ 19. Card networks, such as Visa or MasterCard, are payment processors. Id. An acquiring bank receives purchase receipts from the merchant, pays the merchant, and forwards the receipt to the card's issuer. Id. ¶ 20. GreenState is a card issuer, which issues payment cards to its members and authorizes transaction requests from merchants, reimburses the acquiring bank, and posts the charges on its member's payment card account. Id. ¶¶ 19-20.

From November 2018 to August 2019, computer hackers installed malicious software (malware) on Hy-Vee's point-of-sale systems. Id. ¶ 2. Using this malware, the hackers accessed Hy-Vee customers’ card data, which included the cardholder's name, card number, and expiration date. Id. ¶ 1. GreenState alleges that its members used their payment cards to make purchases at Hy-Vee locations in Minnesota, and "at least one payment card issued by [GreenState] was compromised ... after being used by a member at a Hy-Vee location in Minnesota." Id. ¶ 16.

GreenState alleges that Hy-Vee failed to implement adequate data security measures to protect against data breaches, and failed to timely discover and contain the breach. Id. ¶¶ 3-4. GreenState specifically asserts that Hy-Vee "refused to implement certain best practices, failed to upgrade critical security systems, used outdated point-of-sale systems, ignored warnings about the vulnerability of its computer network, and disregarded and/or violated applicable industry standards." Id. ¶ 3. Hy-Vee allegedly also failed to: hire qualified information technology professionals, respond to warnings about its systems’ susceptibility to hackers, implement protection protocols against malware installation, install adequate monitoring software, and to comply with industry and Federal Trade Commission data security standards. Id. ¶¶ 32, 36-46.

GreenState alleges Hy-Vee's failures harmed it - and other financial institutions - because GreenState was required to cancel compromised cards, reissue new cards, and reimburse members for fraudulent charges. Id. ¶¶ 5, 49. GreenState also alleges that it suffered direct property damage to its payment cards and costs due to lost interest and transaction fees. Id. ¶ 10.

GreenState commenced this action on February 27, 2020, alleging claims under the Minnesota Plastic Card Security Act (PCSA), common law negligence, negligence per se, and for declaratory and injunctive relief. On April 23, 2020, Hy-Vee moved to dismiss for lack of personal jurisdiction or, alternatively, to transfer venue. ECF No. 19. The court denied Hy-Vee's motion. ECF No. 55. Hy-Vee now moves to dismiss the complaint for failure to state a claim.

DISCUSSION

I. Standard of Review

To survive a motion to dismiss, "a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Gallagher v. City of Clayton, 699 F.3d 1013, 1016 (8th Cir. 2012) (citation and internal quotation marks omitted). "A claim has facial plausibility when the plaintiff [has pleaded] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). Although a complaint need not contain detailed factual allegations, it must raise a right to relief above the speculative level. See Twombly, 550 U.S. at 555, 127 S.Ct. 1955. "[L]abels and conclusions or a formulaic recitation of the elements of a cause of action" are not sufficient to state a claim. Iqbal, 556 U.S. at 678, 129 S.Ct. 1937 (citation and internal quotation marks omitted).

"When considering ... a motion to dismiss ... the court generally must ignore materials outside the pleadings, but it may consider some materials that are part of the public record or do not contradict the complaint, as well as materials that are necessarily embraced by the pleadings." Miller v. Redwood Toxicology Lab., Inc., 688 F.3d 928, 931 (8th Cir. 2012) (internal quotations and citations omitted) (citing Porous Media Corp. v. Pall Corp., 186 F.3d 1077, 1079 (8th Cir. 1999) ). Courts may consider "matters incorporated by reference or integral to the claim, items subject to judicial notice, matters of public record, orders, [and] items appearing in the record of the case ... without converting the motion into one for summary judgment." Id. at 931, n.3 (internal quotations omitted) (quoting 5B Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 1357 (3d ed. 2004) ). Therefore, the court may consider the Courtney and Tingley declarations that were filed in support of or opposition to Hy--Vee's previous motion to dismiss or transfer venue.¹ See id. (considering the factual record created by a motion for temporary restraining order, preliminary injunction, and expedited discovery for a motion to dismiss under Fed. R. Civ. P. 12(b)(6) ).

II. Analysis

Hy-Vee argues that this suit should be dismissed because Iowa substantive law applies under choice of law rules, and GreenState fails to state claims under Iowa law. GreenState responds that the choice of law inquiry is premature. If the court conducts the choice of law determination, however, GreenState argues that Minnesota law applies and that it properly pleads its claims. The court determines that the choice of law inquiry is appropriate at this time and that Iowa law applies.²

Discovery is necessary for a choice of law inquiry when it is difficult or not possible for the court to evaluate which states’ laws apply. See P.L. Banks, Inc. v. Organized Fishing, Inc., No. 14-cv-3013, 2015 WL 420288, at *6 (D. Minn. Feb. 2, 2015) ; Cantonis v. Stryker Corp., No. 09-cv-3509, 2010 WL 6239354, at *3 (D. Minn. Nov. 23, 2010), report and recommendation adopted, No. 09-cv-3509, 2011 WL 1084971 (D. Minn. Mar. 21, 2011). Here, the court is satisfied that it has sufficient information to make a choice of law determination because the factual record details where relevant conduct took place. See Lapushner v. Admedus Ltd., No. 20-cv-572, 2020 WL 5106818, at *3 (D. Minn. Aug. 31, 2020).

Federal courts sitting in diversity apply the forum state's conflict of laws rules. Minn. Mining & Mfg. Co. v. Kirkevold, 87 F.R.D. 324, 331 (D. Minn. 1980). "Minnesota's choice-of-law rules involve a multistep analysis." Whitney v. Guys, Inc., 700 F.3d 1118, 1123 (8th Cir. 2012) (citing Christian v. Birch, 763 N.W.2d 50, 56 (Minn. App. 2009) ). Under Minnesota law, the first inquiry is whether an actual conflict of laws exists. Nodak Mut. Ins. Co. v. Am. Family Mut. Ins., 604 N.W.2d 91, 93-94 (Minn. 2000). Next, the court must determine "whether the law of both states can be constitutionally applied." Jepson v. Gen. Cas. Co. of Wis., 513 N.W.2d 467, 469 (Minn. 1994). If there is an outcome determinative conflict and the law of both states can be constitutionally applied, then the court applies Minnesota's multifactor test, which uses the Leflar factors, to determine which states’ law should apply. Whitney, 700 F.3d at 1124 (citing Jepson, 513 N.W.2d at 470 ).

A. Outcome Determinative Conflict

A conflict exists if application of the law of either state would be outcome determinative. Nodak, 604 N.W.2d at 94. There is an outcome determinative conflict pertaining to the...