Pennsylvania State Empl. Cred. v. Fifth Third Bank

• Decision Date: 18 October 2005
• Docket Number: No. CIV. 1:CV-04-1554.,CIV. 1:CV-04-1554.
• Parties: PENNSYLVANIA STATE EMPLOYEES CREDIT UNION, Plaintiff v. FIFTH THIRD BANK and BJ'S Wholesale Club, Inc., Defendants v. BJ'S Wholesale Club, Inc., Third-Party Plaintiff, v. International Business Machines Corporation, Third-Party Defendant
• Court: U.S. District Court — Middle District of Pennsylvania

398 F.Supp.2d 317

PENNSYLVANIA STATE EMPLOYEES CREDIT UNION, Plaintiff v. FIFTH THIRD BANK and BJ'S Wholesale Club, Inc., Defendants v. BJ'S Wholesale Club, Inc., Third-Party Plaintiff, v. International Business Machines Corporation, Third-Party Defendant

No. CIV. 1:CV-04-1554.

United States District Court, M.D. Pennsylvania.

October 18, 2005.

COPYRIGHT MATERIAL OMITTED

Devin J. Chwastyk, Donald B. Kaufman, Kandice J. Giurintano, McNees Wallace & Nurick LLC, Harrisburg, PA, for Plaintiff.

Andrew L. Swope, Christopher R. Nestor, Kirkpatrick & Lockhart Nicholson Graham LLP, Harrisburg, PA, William B. Weigel, Vorys, Sater, Seymour & Pease LLP, Cincinnati, OH, for Defendants.

Benjamin M. Stern, James S. Goldman, James W. Prendergast, Wilmer Cutler Pickering Hale and Dorr, LLP, Boston, MA, Christopher A. Lewis, George J. Krueger, Mark L. Rhoades, Richard L. Kremnick, Blank Rome Comisky & McCauley LLP, Philadelphia, PA, Gordon Pearson, Wilmer Cutler Pickering Hale & Dorr LLP, Washington, DC, for Third-Party Plaintiff.

MEMORANDUM

CALDWELL, District Judge.

I. Introduction.

This case stems from a breach of the computer system used by defendant, BJ's Wholesale Club, Inc., a wholesale club retailer. The system was hacked and bank-card numbers were stolen, allegedly because the computer program BJ's used to process card transactions improperly retained card numbers rather than merely keep them in the system only for the seconds required to validate the transaction.

Some of the numbers stolen belonged to customers of plaintiff, Pennsylvania State Employees Credit Union (PSECU). PSECU filed this lawsuit seeking damages represented by the costs of replacing the cards that had been compromised by the theft. PSECU participates in the system operated by Visa USA Inc., so the cards were Visa cards.

The case was filed in state court against BJ's and Fifth Third Bank, the bank that processes card transactions for BJ's. It was removed here on the basis of diversity jurisdiction. 28 U.S.C. §§ 1332(a) and 1441(a). PSECU then filed an amended complaint. The amended complaint has eight counts. The two defendants have each been sued for breach of contract negligence, equitable indemnification, and unjust enrichment.¹

BJ's added International Business Machines Corporation (IBM), the supplier of the software BJ's used to process transactions, as a third-party defendant, alleging that IBM's software failed to comply with BJ's request that it not retain card numbers. The third-party complaint sought recovery from IBM of whatever damages PSECU recovered from BJ's. On IBM's motion to dismiss, we allowed BJ's to seek recovery of the value of the compromised bank cards as blanks. See Pennsylvania State Employees Credit Union v. Fifth Third Bank, 2005 WL 1154594 (M.D.Pa.2005). IBM has moved for reconsideration of that ruling, seeking complete dismissal of the complaint against it.

The defendants have each filed separate motions to dismiss under Fed.R.Civ.P. 12(b)(6), arguing that none of the claims states a valid cause of action. BJ's motion argues principally as follows. First, PSECU's breach-of-contract claim (predicated on third-party-beneficiary status) fails because BJ's has no contract with Visa and its contracts with Fifth Third affirmatively exclude third-party beneficiaries. Second, PSECU's negligence claim fails because it is barred by the economic loss doctrine and by the gist of the action doctrine. Third, the equitable-indemnification claim fails because PSECU was fulfilling a contractual obligation of its own in replacing the cards and in these circumstances cannot look to BJ's for reimbursement. Fourth, the unjust enrichment claim fails because Plaintiff has not alleged it paid damages to a third party.

In its motion, Fifth Third principally argues as follows. First, PSECU has no breach-of-contract claim against it because PSECU is not a third-party beneficiary of Fifth Third's contract with Visa, the basis of the contract claim against Fifth Third. Second, PSECU has no negligence claim because Fifth Third owed it no duty of reasonable care, an essential element of a negligence claim, because duty cannot be based on contractual obligations, as PSECU attempts to do here. Additionally, a negligence claim cannot be pursued without physical harm to person or property; purely economic losses are not sufficient. Third, the indemnity claim fails because: (1) PSECU is entitled to indemnity only if Fifth Third committed a tort against the cardholders, and it committed no tort; (2) PSECU is entitled to indemnity only if its cardholders suffered a loss, but they did not do so because federal law imposes the loss for the unauthorized charges on PSECU and excuses the cardholders; (3) PSECU cannot be secondarily liable to Fifth Third because PSECU accuses Fifth Third of failing to detect the defect in BJ's computer system, a theory of secondary liability itself; and (4) PSECU cannot be secondarily liable because both contractual obligations and federal law make PSECU primarily liable for the fraudulent transactions. Fourth, the unjust enrichment claim fails, in part, because PSECU was fulfilling a contractual obligation of its own in replacing the cards.

II. Standard of Review.

In considering Defendants' motions to dismiss, we must accept as true the factual allegations in the complaint and construe any inferences to be drawn from them in Plaintiff's favor. See Mariana v. Fisher, 338 F.3d 189, 195 (3d Cir.2003). We may dismiss a complaint under Fed.R.Civ.P. 12(b)(6) only if it is clear that no relief could be granted to Plaintiff under "any set of facts that could be proven consistent with the allegations." Ramadan v. Chase Manhattan Corp., 229 F.3d 194, 195 (3d Cir.2000). The court is not limited to evaluating the complaint alone; it can also consider documents attached to the complaint, matters of public record, and other documents that are indisputably authentic. Pension Ben. Guar. Corp. v. White Consol. Indus., 998 F.2d 1192, 1196 (3d Cir.1993). The court may also consider "documents whose contents are alleged in the complaint and whose authenticity no party questions," even though they "are not physically attached to the pleading...." Pryor v. Nat'l Collegiate Athletic Ass'n, 288 F.3d 548, 560 (3d Cir.2002).

III. Background.

The complaint alleges the following. PSECU is a Pennsylvania credit union with its principal office in Harrisburg, Pennsylvania. (Doc. 61, Am. Compl. ¶¶ 1 and 6.) Defendant BJ's, a seller of wholesale goods, is a Delaware corporation with its principal place of business in Massachusetts. (Id. ¶¶ 2 and 10.) Defendant Fifth Third is an Ohio corporation with its principal place of business in Ohio. (Id. ¶ 3.) "Visa is a privately-held, for-profit association, which supports Visa-brand cards issued by financial institutions (`Issuing Banks') to consumers, and processes transactions made with those cards on behalf of `Acquiring Banks' and `Merchants' enrolled in its program." (Id. ¶ 7.) PSECU is an issuing bank, issuing Visa cards to its members (id. ¶ 8), for use in retail purchases from merchants. Fifth Third is an acquiring bank, processing Visa card transactions on behalf of merchants, and is the acquiring bank for BJ's. (Id. ¶¶ 9 and 11.) BJ's is a Visa merchant and accepts Visa card transactions from consumers. (Id. ¶¶ 10.)

Visa has extensive operating regulations. (Id. ¶ 13.) The regulations require an acquiring bank to guarantee that its merchants will abide by them (id. ¶ 16), and to include in its contract with its merchants a provision requiring the merchant to abide by the regulations, including security regulations, specifically, those regulations prohibiting disclosure of account information, magnetic-stripe information and transaction information. (Id. ¶ 20.) The regulations "require Fifth Third to accept responsibility for any and all losses caused by BJ's failure to comply with the" operating regulations. (Id. ¶ 22.)

In turn, Fifth Third has a contract with Visa that requires Fifth Third to comply with the operating regulations. (Id. ¶ 14.) Under "Fifth Third's contract with Visa, Fifth Third: guarantees BJ's compliance with the Visa Operating Regulations ...; guarantees that BJ's will properly secure magnetic stripe information; guarantees that BJ's will not retain such information subsequent to authorization of a transaction; and, guarantees that BJ's will not disclose such information to unauthorized third parties." (Id. ¶ 23.)

Fifth Third has a contract with BJ's that requires BJ's to comply with the operating regulations. (Id. ¶ 15; Doc. 69, BJ's Exs. 1 and 2.) Those regulations forbid BJ's from: (1) "disclosing any Visa cardholder account numbers, magnetic stripe information, or transaction information to third parties other than the Merchant's agents," the acquiring bank, or the acquiring bank's agents; or (2) "retaining or storing Visa card magnetic stripe data subsequent to authorization of a transaction." (Id., ¶¶ 26 and 27).

Fifth Third and BJ's have contracted by way of two merchant agreements. One governs the processing of debit-card transactions ( Doc. 69, BJ's Ex. 1.) and the other credit-card transactions. (Id., BJ's Ex. 2.) Both contain the following language, quoting in a pertinent part from paragraph 16 of each agreement: "This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." Both agreements also have a choice-of-law provision, requiring them to be "governed, construed and enforced" under Ohio law. (Id., Exs. 1 and 2, ¶ 23.) Both also prohibit, in pertinent part, BJ's from disclosing a cardholder's name, address or account number to third parties without written consent. (Id., Exs. 1 and 2, ¶ 8.)

From at least July 1, 2003, through February 29, 2004, BJ's retained, and failed to...