© 2013 The Texas Lawbook.
By David Coale
Special Contributing Writer to The Texas Lawbook
(September 9) – In one of the largest “data breach” cases ever, hackers broke into the computers of Heartland Payment Systems, a credit card processor, and stole confidential information about millions of cards. Much litigation followed, including claims by the issuing banks for damages, such as the cost of replacing compromised credit cards and reimbursing customers for wrongful charges.
A federal district court in Houston dismissed the banks’ claims based on the “economic loss rule.” The Fifth Circuit recently reversed, finding the complaint had enough legal merit to survive a motion to dismiss on the pleadings. Lone Star National Bank v. Heartland Payment Systems, ___ F.3d ___, No. 12-20648 (Sept. 3, 2013).
The economic loss rule is a general bar to recovery in negligence for pure economic loss. The parties agreed that the Texas version of the rule (which imposes a physical injury requirement) would not allow recovery for the banks.
Under New Jersey law, however, the Fifth Circuit found that the economic loss rule did not bar the negligence claim pleaded by the banks. Examining the criteria set by the New Jersey Supreme Court, the Court concluded that the banks were an “identifiable class,” that Heartland’s liability would not be “boundless” because it would run only to the banks, and the banks may otherwise have no legal remedy.
Noting that a purpose of the economic loss rule is to encourage parties to allocate economic risks with contracts, the Court noted that the record before it was not clear about what contracts the parties had. The Court declined to affirm dismissal on several other grounds such as choice of law and collateral estoppel, “as they are better addressed by the district court in the first instance.”
While the opinion is clearly important in this major lawsuit, its impact in other data breach cases is less clear. The case will likely have little effect on consumer class actions, which involve thousands of potential claimants as opposed to a handful of banks, and where many consumers do not even suffer economic loss from a successfully-contained data breach. Among companies who must bear the cost of containing a breach, however, the opinion could give significant leverage to banks, retailers, and other end-users of data processing services who may not have contractual privity with all relevant parties.
The opinion could also influence multi-party litigation outside the area of data breach. The district court’s analysis discussed the “web of contracts” among the parties, and weighed that in favor of the economic loss rule and against tort recovery for the banks. Other commercial settings, such as sophisticated manufacturing arrangements and large construction projects, can involve similar “webs.” The opinion could support arguments for liability among parties in such “webs” that their contracts might not otherwise allow.
The opinion also teaches an unexpected lesson about litigation involving “cyberspace” -– territory that pundits often describe as lying outside traditional state boundaries. Here, the choice of governing state law was outcome-determinative. The opinion is a useful reminder that “old-school” choice of law among sovereigns still carries weight in the modern era.
© 2013 The Texas Lawbook. Content of The Texas Lawbook is controlled and protected by specific licensing agreements with our subscribers and under federal copyright laws. Any distribution of this content without the consent of The Texas Lawbook is prohibited.
If you see any inaccuracy in any article in The Texas Lawbook, please contact us. Our goal is content that is 100% true and accurate. Thank you.