Haynes and Boone, LLP won a significant case before the U.S. Court of Appeals for the Sixth Circuit that sets important limitations on the liability of merchants who have been victimized by data breaches.
In 2012 and 2013, firm client Spec’s Family Partners, a popular specialty retailer with locations throughout Texas, suffered a criminal attack on its network that allegedly compromised the payment card information of some of its customers. The credit card brands levied millions of dollars of assessments for operational reimbursements and fraud recovery against Spec’s credit card processor, First Data Merchant Services, who then tried to recoup its losses from Spec’s by unilaterally withholding the funds from purchases customers made at Spec’s stores.
Spec’s disputed its liability and filed suit when First Data refused to return the withheld funds. Spec’s argued that it was not obligated to pay the assessments because its contract with First Data excluded liability for “special, indirect, incidental or consequential losses or damages.” Spec’s further argued that the assessments were not “third-party fees and charges” Spec’s was required to pay under the contract.
In 2017, the U.S. District Court for the Western District of Tennessee sided with Spec’s, ruling on a motion for summary judgment that the retailer was not liable for the assessments because (i) they were consequential damages excluded by the card processing contract, and (ii) they were not third-party fees and charges as defined in the contract. The 6th Circuit affirmed the district court.
“This is a significant victory for Spec’s and, more broadly, for merchants, who often pay substantial assessments after data security breaches,” said Spec’s lead counsel, Ron Breaux. “The 6th Circuit ruling underscores that merchants may have legal options to avoid such payments.”
Breaux said it is unusual for merchants to claim this sort of legal victory. “Payment card processors and card brands like merchants to believe they are automatically required to indemnify them for any and all costs arising from a data breach. At a time when these breaches are sadly prevalent, this is a reminder that other avenues may be available to merchants.”
Breaux was assisted in the case by Haynes and Boone Partners Emily Westridge Black and Timothy Newman, and by other members of Haynes and Boone’s multi-disciplinary Privacy and Data Security Group. Lawyers in the group have decades of experience negotiating data processing agreements, conducting investigations, and litigating sophisticated commercial matters. The team helps ensure compliance with national, international, and industry-specific privacy laws, investigates cyber incidents, and represents clients in related disputes.
Haynes and Boone is an international corporate law firm with offices in Texas, New York, California, Charlotte, Chicago, Denver, Washington, D.C., London, Mexico City and Shanghai, providing a full spectrum of legal services in energy, technology, financial services and private equity. With 575 lawyers, Haynes and Boone is ranked among the largest U.S.-based firms by The National Law Journal, The American Lawyer and The Lawyer.
The following publications covered the win:
Law360 (Subscription required)
Women's Wear Daily (Subscription required)