Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Co-Authored by: <a href="http://www.bakerlaw.com/JudySelby">Judy Selby</a> In a highly anticipated decision, a federal court in Tennessee let stand a retailer&rsquo;s claims against Visa for violation of California&rsquo;s Unfair Competition Law (UCL) and for common law claims for unjust enrichment and restitution arising out of fines and assessments levied by Visa in the wake of a massive data theft against the retailer.&nbsp; <a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2013/07/orderdenyingvisa.pdf">Genesco Inc. v. Visa USA Inc., et al., case no. 3:13-cv-00202 (MD TN July 18, 2013)</a>. The retailer, Genesco Inc. (Genesco), operates more than 2,400 retail stores throughout the US and internationally, selling hats and footwear under various names including Journeys, Lids and Johnson &amp; Murphy.&nbsp;&nbsp; Visa Inc. (Visa), through its principal subsidiary in the US, operates a retail electronic payments network to facilitate payment to financial institutions and businesses for consumer credit and debit card purchases. Financial institutions that participate in Visa&rsquo;s system sign licensing agreements as &ldquo;issuers&rdquo; and/or &ldquo;acquirers&rdquo; of visa credit and/or debit cards. &nbsp;Wells Fargo Bank and Fifth Third Bank were&nbsp;Genesco&rsquo;s acquiring banks.&nbsp;&nbsp;Genesco's agreements with those banks required Genesco to comply with Visa&rsquo;s International Operating Regulations (VIOR) and the Payment Card Industry Data Security Standards (PCI&nbsp;DSS). The PCI&nbsp;DSS&nbsp;establish data security standards for companies that process, store, or handle card data. In its contracts with&nbsp;its acquiring banks, Genesco agreed to indemnify them for all fees, assessments and penalties imposed on them by Visa. From December 2009 to December 2010, hackers accessed Genesco&rsquo;s computer network, utilizing a packet-sniffing malware that captured unencrypted credit card data at the point of sale (POS) as the data was being transmitted to Wells Fargo and Fifth Third for authorization.&nbsp; After the breach was discovered, Visa claimed that every card processed by Genesco over a one-year period was compromised.&nbsp; Visa assessed fines of $13.3 million.&nbsp; As required by its contracts, Genesco indemnified Wells Fargo and Fifth Third for that amount.&nbsp; Genesco then sued Visa for recoupment under theories of breach of contract, unjust enrichment, and violation of the California UCL.&nbsp; Genesco obtained an assignment from Wells Fargo of all rights/claims Wells Fargo had as to Visa. In its complaint, Genesco claimed that it never actually violated the PCI DSS standards because the standards did not require the POS data to be encrypted when transmitted for authorization, and that Visa had not shown that the fine reflected compensation for any actual harm caused by the breach.&nbsp; Genesco alleged that the forensic evidence demonstrated that no accounts had been compromised by the cyber attack.&nbsp; The fine, therefore, was alleged to be contrary to VIOR and a legally unenforceable penalty. In response to the complaint, Visa filed a partial motion to dismiss, arguing that Genesco did not adequately plead fraud in connection with the UCL and common law claims, Genesco could not rely on Visa&rsquo;s contracts with the banks to assert a UCL claim, Genesco -- which was not a party to the contracts with Visa -- could not seek restitution pursuant to those contracts, and the contracts precluded Genesco&rsquo;s common law claims for equitable relief.&nbsp; Genesco countered that Visa&rsquo;s breaches of its contracts with the banks can state claims under the UCL, it adequately pled fraud in connection with the UCL, and that restitution is available to Genesco, because the funds for the unlawful fines and assessments against the banks are traceable to Genesco, which was the source of the payments to Visa. The court denied Visa&rsquo;s motion in total.&nbsp; The court held that &ldquo;claims based on contracts of commercial entities where breaches of such contract violate public policy or harm competition or consumers&rdquo; are actionable under California&rsquo;s UCL.&nbsp; &ldquo;Here, Genesco asserts claims that Visa&rsquo;s fines and assessments against the banks that Genesco actually paid, lacked a factual basis and were contrary to Visa&rsquo;s agreements with the banks and were contrary to the forensic evidence about the effects&nbsp; of the cyber attack on Genesco&rsquo;s computer system.&nbsp; Genesco asserts that these fines are also penalties that are unenforceable as a matter of California law.&nbsp; Moreover, Visa&rsquo;s alleged imposition of more than $13 million &hellip; in fines and assessments, without a factual basis and in violation of Visa&rsquo;s standards, impacts retail transactions involving consumers, retail merchants and other banks and implicate the fairness in the credit and debit card markets.&rdquo;&nbsp; Therefore, &ldquo;Visa&rsquo;s contracts and VIOR create a structure or &lsquo;environment&rsquo; that could be found to be harmful to competition at the merchant level and establish unfairness in the market for credit and debit transactions of which merchants and consumers are key players.&rdquo;&nbsp;&nbsp; The court also noted that a &ldquo;direct relationship with the defendant is not necessary for a UCL claim so long as the Plaintiff suffered an injury or loss of funds due to the Defendant&rsquo;s practice.&rdquo;&nbsp; The court therefore concluded that Genesco&rsquo;s UCL and common law claims under California law were actionable.

Visa Loses Motion to Dismiss in Genesco Case – Are the Days for PCI Assessments Numbered?