Haynes and Boone, LLP Partner Emily Westridge Black talked with Women’s Wear Daily about an appeals court ruling obtained by the firm in favor of Spec’s Family Partners, a liquor retailer in Texas that was the victim of criminal attacks on its payment card network. The case sets important limitations on the liability of merchants who have been victimized by data breaches.
Here is an excerpt:
When a data breach compromises the credit and debit card information of a retailer’s consumers, who is liable for losses? Turns out, it’s not always the retailer. At least, that’s according to a Sixth Circuit appeals court ruling on Friday in a case involving a liquor retailer in Texas.
Spec’s Family Partners, which runs dozens of liquor stores in Texas, encountered data breaches in 2012 and 2013 that targeted its payment card network. The fallout highlighted a chain of liability governed by a web of contracts between the players often involved in these scenarios — the retailer, credit card companies, banks and in this case, a credit card processing company called First Data Merchant Services that Spec’s had a contract with.
The contract between Spec’s and First Data was the key, which the courts scrutinized to assess whether Spec’s bore liability to First Data. The court found that the contract exempted Spec’s in this case.
“Whenever there’s a data breach, usually it’s an all-hands-on-deck emergency, and it can be hard to be clear-sighted in that situation,” said Emily Westridge Black, a partner at Haynes and Boone, who represented Spec’s in this case. “It’s important for retailers to pause and pay attention to anything they would in a normal dispute, including the contracts, applicable statutes, and regulatory regime.”
The case highlights the complex relationships between retailers and credit card companies, which often involve several intermediaries.
The Haynes and Boone team representing Spec’s included Black, Partner Ron Breaux as lead counsel, Partner Timothy Newman, and other members of Haynes and Boone’s multi-disciplinary Privacy and Data Security Group.
To read the full article, click here. (Subscription required)