Opinion
CIVIL NO. 20-621(DSD/DTS)
2021-07-19
GREENSTATE CREDIT UNION on Behalf of Itself and All Others Similarly Situated, Plaintiff, v. HY-VEE, INC., Defendant.
Kate M. Baxter-Kauf, Esq. and Lockridge Grindal Nauen PLLP, 100 Washington Avenue South, Suite 2200, Minneapolis, MN 55401, counsel for plaintiff. Paul G. Karlsgodt, Esq. and Baker & Hostetler LLP, 1801 California Street, Suite 4400, Denver, CO 80202, counsel for defendant.
Kate M. Baxter-Kauf, Esq. and Lockridge Grindal Nauen PLLP, 100 Washington Avenue South, Suite 2200, Minneapolis, MN 55401, counsel for plaintiff.
Paul G. Karlsgodt, Esq. and Baker & Hostetler LLP, 1801 California Street, Suite 4400, Denver, CO 80202, counsel for defendant.
ORDER
David S. Doty, Judge The matter is before the court upon defendant Hy-Vee, Inc.’s motion to dismiss. Based on a review of the file, record, and proceedings herein, and for the following reasons, the court grants the motion.
BACKGROUND
This class action dispute arises out of Hy-Vee's handling of a data breach that exposed consumers’ credit card data. Plaintiff GreenState Federal Credit Union is a federally chartered credit union with its principal place of business in Iowa. Compl. ¶ 7. Hy-Vee is incorporated in Iowa and has its principal place of business in Iowa. Id. ¶ 12. Hy-Vee operates supermarkets, convenience stores, and gas stations, with 240 retail stores in eight states, including Minnesota. Id. ¶ 13.
GreenState has twenty-six branch locations, all located in Iowa. Courtney Decl. ¶ 2; ECF No. 55, at 3. GreenState membership is open to: (1) individuals living and working in Iowa, as well as some counties in Illinois or Wisconsin that border Iowa; (2) University of Iowa students, staff, and alumni; and (3) direct relatives of current members. Id. ¶¶ 3-5; ECF No. 55, at 3. 1,158 of approximately 210,000 members - about one-half of one percent - have Minnesota addresses. Id. ¶ 7; ECF No. 55, at 3.
Thirty-eight of Hy-Vee's 264 stores are in Minnesota. Tingley Decl. ¶¶ 1, 3; ECF No. 55, at 3. 12.38% of Hy-Vee's revenue comes from Minnesota, and 13.77% of Hy-Vee's employees work in Minnesota. Id. ¶ 3; ECF No. 55, at 4. Hy-Vee's information technology department, chief technology officer, and information security team operate in Iowa. Id. ¶¶ 7-8; ECF No. 55, at 4. They are responsible for decisions regarding Hy-Vee's data and information security policy and practices, all of which are made in Iowa. Id. ¶¶ 6-10; ECF No. 55, at 4.
In payment card transactions, there are four primary parties: the merchant, the acquiring bank, the card network, and the card issuer. Compl. ¶¶ 19-20. In this context, Hy-Vee is a merchant that requests authorization of the transaction from the card's issuer. Id. An acquiring bank contracts with the merchant to process the transaction. Id. ¶ 19. Card networks, such as Visa or MasterCard, are payment processors. Id. An acquiring bank receives purchase receipts from the merchant, pays the merchant, and forwards the receipt to the card's issuer. Id. ¶ 20. GreenState is a card issuer, which issues payment cards to its members and authorizes transaction requests from merchants, reimburses the acquiring bank, and posts the charges on its member's payment card account. Id. ¶¶ 19-20.
From November 2018 to August 2019, computer hackers installed malicious software (malware) on Hy-Vee's point-of-sale systems. Id. ¶ 2. Using this malware, the hackers accessed Hy-Vee customers’ card data, which included the cardholder's name, card number, and expiration date. Id. ¶ 1. GreenState alleges that its members used their payment cards to make purchases at Hy-Vee locations in Minnesota, and "at least one payment card issued by [GreenState] was compromised ... after being used by a member at a Hy-Vee location in Minnesota." Id. ¶ 16.
GreenState alleges that Hy-Vee failed to implement adequate data security measures to protect against data breaches, and failed to timely discover and contain the breach. Id. ¶¶ 3-4. GreenState specifically asserts that Hy-Vee "refused to implement certain best practices, failed to upgrade critical security systems, used outdated point-of-sale systems, ignored warnings about the vulnerability of its computer network, and disregarded and/or violated applicable industry standards." Id. ¶ 3. Hy-Vee allegedly also failed to: hire qualified information technology professionals, respond to warnings about its systems’ susceptibility to hackers, implement protection protocols against malware installation, install adequate monitoring software, and to comply with industry and Federal Trade Commission data security standards. Id. ¶¶ 32, 36-46.
GreenState alleges Hy-Vee's failures harmed it - and other financial institutions - because GreenState was required to cancel compromised cards, reissue new cards, and reimburse members for fraudulent charges. Id. ¶¶ 5, 49. GreenState also alleges that it suffered direct property damage to its payment cards and costs due to lost interest and transaction fees. Id. ¶ 10.
GreenState commenced this action on February 27, 2020, alleging claims under the Minnesota Plastic Card Security Act (PCSA), common law negligence, negligence per se, and for declaratory and injunctive relief. On April 23, 2020, Hy-Vee moved to dismiss for lack of personal jurisdiction or, alternatively, to transfer venue. ECF No. 19. The court denied Hy-Vee's motion. ECF No. 55. Hy-Vee now moves to dismiss the complaint for failure to state a claim.
DISCUSSION
I. Standard of Review
To survive a motion to dismiss, "a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Gallagher v. City of Clayton, 699 F.3d 1013, 1016 (8th Cir. 2012) (citation and internal quotation marks omitted). "A claim has facial plausibility when the plaintiff [has pleaded] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). Although a complaint need not contain detailed factual allegations, it must raise a right to relief above the speculative level. See Twombly, 550 U.S. at 555, 127 S.Ct. 1955. "[L]abels and conclusions or a formulaic recitation of the elements of a cause of action" are not sufficient to state a claim. Iqbal, 556 U.S. at 678, 129 S.Ct. 1937 (citation and internal quotation marks omitted).
"When considering ... a motion to dismiss ... the court generally must ignore materials outside the pleadings, but it may consider some materials that are part of the public record or do not contradict the complaint, as well as materials that are necessarily embraced by the pleadings." Miller v. Redwood Toxicology Lab., Inc., 688 F.3d 928, 931 (8th Cir. 2012) (internal quotations and citations omitted) (citing Porous Media Corp. v. Pall Corp., 186 F.3d 1077, 1079 (8th Cir. 1999) ). Courts may consider "matters incorporated by reference or integral to the claim, items subject to judicial notice, matters of public record, orders, [and] items appearing in the record of the case ... without converting the motion into one for summary judgment." Id. at 931, n.3 (internal quotations omitted) (quoting 5B Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 1357 (3d ed. 2004) ). Therefore, the court may consider the Courtney and Tingley declarations that were filed in support of or opposition to Hy--Vee's previous motion to dismiss or transfer venue. See id. (considering the factual record created by a motion for temporary restraining order, preliminary injunction, and expedited discovery for a motion to dismiss under Fed. R. Civ. P. 12(b)(6) ).
Both parties cite the Courtney and Tingley declarations in their briefs as part of the factual record. The declarations do not contradict the complaint, and both parties embrace the materials and do not dispute their authenticity.
II. Analysis
Hy-Vee argues that this suit should be dismissed because Iowa substantive law applies under choice of law rules, and GreenState fails to state claims under Iowa law. GreenState responds that the choice of law inquiry is premature. If the court conducts the choice of law determination, however, GreenState argues that Minnesota law applies and that it properly pleads its claims. The court determines that the choice of law inquiry is appropriate at this time and that Iowa law applies.
The parties do not dispute that only Minnesota and Iowa law are relevant for the choice of law analysis.
Discovery is necessary for a choice of law inquiry when it is difficult or not possible for the court to evaluate which states’ laws apply. See P.L. Banks, Inc. v. Organized Fishing, Inc., No. 14-cv-3013, 2015 WL 420288, at *6 (D. Minn. Feb. 2, 2015) ; Cantonis v. Stryker Corp., No. 09-cv-3509, 2010 WL 6239354, at *3 (D. Minn. Nov. 23, 2010), report and recommendation adopted, No. 09-cv-3509, 2011 WL 1084971 (D. Minn. Mar. 21, 2011). Here, the court is satisfied that it has sufficient information to make a choice of law determination because the factual record details where relevant conduct took place. See Lapushner v. Admedus Ltd., No. 20-cv-572, 2020 WL 5106818, at *3 (D. Minn. Aug. 31, 2020).
Federal courts sitting in diversity apply the forum state's conflict of laws rules. Minn. Mining & Mfg. Co. v. Kirkevold, 87 F.R.D. 324, 331 (D. Minn. 1980). "Minnesota's choice-of-law rules involve a multistep analysis." Whitney v. Guys, Inc., 700 F.3d 1118, 1123 (8th Cir. 2012) (citing Christian v. Birch, 763 N.W.2d 50, 56 (Minn. App. 2009) ). Under Minnesota law, the first inquiry is whether an actual conflict of laws exists. Nodak Mut. Ins. Co. v. Am. Family Mut. Ins., 604 N.W.2d 91, 93-94 (Minn. 2000). Next, the court must determine "whether the law of both states can be constitutionally applied." Jepson v. Gen. Cas. Co. of Wis., 513 N.W.2d 467, 469 (Minn. 1994). If there is an outcome determinative conflict and the law of both states can be constitutionally applied, then the court applies Minnesota's multifactor test, which uses the Leflar factors, to determine which states’ law should apply. Whitney, 700 F.3d at 1124 (citing Jepson, 513 N.W.2d at 470 ).
A. Outcome Determinative Conflict
A conflict exists if application of the law of either state would be outcome determinative. Nodak, 604 N.W.2d at 94. There is an outcome determinative conflict pertaining to the Minnesota PCSA claim because there is no analogous Iowa statute. The parties dispute, however, whether there is an outcome determinative conflict regarding GreenState's negligence claims. At issue is whether Iowa's economic loss rule bars GreenState's negligence claims. The court finds that it does, and, therefore, there is an outcome determinative conflict.
GreenState concedes that there is an outcome determinative conflict in this respect.
GreenState argues that Minnesota law would not bar its negligence claims, and Hy-Vee raises no argument in opposition.
"A federal court sitting in diversity interprets state law and does not contravene clear directives from state supreme courts." Dziadek v. Charter Oak Fire Ins. Co., 867 F.3d 1003, 1011 (8th Cir. 2017) ; see also Karas v. Am. Fam. Ins. Co., 33 F.3d 995, 1000 (8th Cir. 1994) ("As a federal court, our role is to interpret state law in diversity cases and not to fashion it."). In Annett Holdings, Inc. v. Kum & Go, L.C., 801 N.W.2d 499 (Iowa 2011), the Iowa Supreme Court endorsed the economic loss rule. "[T]he economic loss rule bars recovery in negligence when the plaintiff has suffered only economic loss." Id. at 503 (citing Neb. Innkeepers, Inc. v. Pittsburgh-Des Moines Corp., 345 N.W.2d 124, 126 (Iowa 1984) ). Without any physical or direct harm occurring to property or persons, plaintiff cannot recover for purely economic or business loss. See Neb. Innkeepers, Inc., 345 N.W.2d at 126-29.
GreenState argues that payment card data is akin to "property" that can be "damaged," and, consequently, it is not economic loss. The data breach rendered the payment cards, and its accompanying data, useless and valueless, and GreenState had to mitigate additional damages, including the replacement and reissuing of payment cards. The court finds GreenState's argument unpersuasive.
GreenState argues that, because computer data is considered property in the criminal context, it should be considered property in the civil context. See Iowa Code Ann. §§ 702.14, 702.01A(10). GreenState does not cite any Iowa caselaw, however, where computer data is considered property in the civil context, and the court will not expand the criminal definition's application. See Karas, 33 F.3d at 1000 ("[O]ur role is to interpret state law in diversity cases and not to fashion it.").
The Iowa Supreme Court held that the economic loss doctrine bars negligence claims against a convenience store for fraudulent and unauthorized payment card use by a third party. Annett Holdings, Inc., 801 N.W.2d at 506. In Annett Holdings, one of plaintiff's employees misused plaintiff's payment cards to withdraw money for himself. Id. at 501. The employee would use the payment card – which was for the purpose of purchasing fuel and obtaining cash advances – to print cash advance slips and presented the slips to the convenience store. Id. The employee falsely claimed he was authorized to pay for other employees’ fuel purchases, and the convenience store paid him in cash. Id. Plaintiff alleged that the convenience store was negligent in providing cash to the employee. Id. at 502.
The court held that plaintiff's negligence claim was barred by the economic loss rule. Id. at 504. The court explained that unauthorized withdrawals of cash charged on the card, and ultimately charged to plaintiff, were indirect economic losses to plaintiff. Id. at 502 ("No one was injured [and] no property was damaged or destroyed."). The Iowa Supreme Court cited favorably to and described Cumis Insurance Society, Inc. v. BJ's Wholesale Club, Inc., 455 Mass. 458, 918 N.E.2d 36 (2009), a Massachusetts Supreme Judicial Court case which applied the economic loss doctrine to a "similar claim[ ]." Id. In Cumis, credit unions and their insurers brought negligence claims against a retailer that "improperly stored credit card data in a manner that allowed thieves to access the data," resulting in fraudulent credit card use. Id. (citing Cumis Ins. Society, Inc., 918 N.E.2d at 39-40 ). The Cumis court barred the credit unions’ negligence claim under the economic loss doctrine. Id. (citing Cumis Ins. Society, Inc., 918 N.E.2d at 39-40 ). It rejected the credit unions’ contention that compromised credits cards were tangibly damaged because the credit unions had to replace and reissue compromised cards. Id. (citing Cumis Ins. Society, Inc., 918 N.E.2d at 46-47 ).
Here, GreenState's negligence claim would be barred by Iowa's economic loss doctrine. GreenState's alleged injuries - cancelling compromised cards, reissuing new cards, reimbursing members for fraudulent charges, and losing interest and transaction fees because of reduced card use – are all indirect economic losses. GreenState's injuries do not constitute property damage to its members’ payment cards. Because GreenState alleges nothing more than economic losses, Iowa law bars its negligence claims.
GreenState argues that Annett Holdings is distinguishable from this case. In Annett Holdings, plaintiff also had a contract with the payment card issuer, in which plaintiff assumed responsibility for unauthorized or fraudulent use of payment cards by its employees. Id. The payment card issuer also had a contract with the convenience store. Id. Consequently, the court found that the parties entered into a "chain of contracts" and specifically applied the "contractual economic loss rule," which is an economic loss theory that tort law should not replace "a consensual network of contracts." Id. at 505. GreenState argues that there are no allegations of a similar contract with the payment card issuer, and, consequently, Annett Holdings and the economic loss rule are wholly inapplicable. The court, too, finds this argument unpersuasive.
The parties dispute whether GreenState entered into contracts with payment card providers. Hy-Vee attaches Visa and MasterCard Rules to its brief to argue that GreenState has contracts with payment card issuers. GreenState does not allege the contents of the payment card rules or contracts. The court does not consider these rules because they are matters outside the pleadings and are not necessarily embraced by the pleadings. See Ashanti v. City of Golden Valley, 666 F.3d 1148, 1150–51 (8th Cir. 2012).
Important to the economic loss inquiry is whether plaintiff's claim "bears a number of characteristics that bring it within the scope of the economic loss rule." Id. at 504. As described above, GreenState seeks to recover remote economic loss. Furthermore, as the Annett Holdings court explains, the rule is not limited to cases where parties are in direct contractual privity. Id. The "stranger economic loss" rule prevents plaintiffs from seeking purely economic losses from remote third parties. Id.; see also Neb. Innkeepers, Inc., 345 N.W.2d at 128-29 (holding that plaintiff cannot recover purely economic losses against bridge contractor that negligently caused bridge to close); Anderson Plasterers v. Meinecke, 543 N.W.2d 612, 613-14 (Iowa 1996) (refusing employer's negligence claim to recover economic losses from negligent third party who injured plaintiff's employees). The rule aims to limit "potentially limitless liability" resulting from "economic reverberations" and "encourages parties to enter into contracts." Id.
As discussed above, GreenState seeks to recover purely economic losses. Hy-Vee has no direct contractual privity with GreenState. Hy-Vee, a merchant, and GreenState, an issuing bank, are separated by a multistep payment card transaction process and intervening parties. Hy-Vee and GreenState's connection in this transaction is too remote, and, thus, their relationship to one another fits squarely within the stranger economic loss rule.
GreenState's negligence claims would be barred under Iowa law, which makes the choice of law inquiry outcome determinative.
B. Constitutional Application of State Law
A state's law may be constitutionally applied if that state has "a significant contact or significant aggregation of contacts, creating state interests, such that choice of its law is neither arbitrary nor fundamentally unfair." Jepson, 513 N.W.2d at 469-70 (quoting Allstate Ins. Co. v. Hague, 449 U.S. 302, 312–13, 101 S.Ct. 633, 66 L.Ed.2d 521 (1981) ). "[P]rotection of out-of-state parties’ constitutional rights requires an inquiry into their claims’ contacts with Minnesota and their individual state laws before concluding Minnesota law may apply." In re St. Jude Med., Inc., 425 F.3d 1116, 1120 (8th Cir. 2005). "When considering fairness in this context, an important element is the expectation of the parties." Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 822, 105 S.Ct. 2965, 86 L.Ed.2d 628 (1985).
As a preliminary matter, both parties cite the court's previous personal jurisdiction analysis as support for their arguments. "Personal jurisdiction and choice of law, however, present distinct inquiries." Superior Edge, Inc. v. Monsanto Co., 964 F. Supp. 2d 1017, 1033 n.4 (D. Minn. 2013) (rejecting the argument that because the court has personal jurisdiction over defendant in Minnesota that it requires the court to apply Minnesota law). The court's determination regarding personal jurisdiction does not bind it here.
Whether the court could constitutionally apply Minnesota law is a close call. On the one hand, the contacts of GreenState's claims with Minnesota are not seemingly significant. GreenState's injury – cancelling compromised cards, reissuing new cards, and reimbursing members – is felt in Iowa. The actions and omissions by Hy-Vee giving rise to GreenState's claims – its data security decision-making and the actions of the information technology department – all occurred in Iowa. Both parties are Iowa residents. On the other hand, Glover v. Merck & Co., Inc., 345 F. Supp. 2d 994, 997-98 (D. Minn. 2004), suggests that Hy-Vee doing business and processing payment cards in Minnesota may be sufficient for constitutional purposes. Even if the court found that it could constitutionally apply Minnesota law, the choice of law factors weigh in favor of Iowa law.
C. Minnesota Choice of Law Factors
The court evaluates the following factors to determine which law to apply: "(1) predictability of result; (2) maintenance of interstate and international order; (3) simplification of the judicial task; (4) advancement of the forum's governmental interest; and (5) application of the better rule of law." Whitney, 700 F.3d at 1124 (quoting Jepson, 513 N.W.2d at 470 ). The parties agree that the third factor is neutral and that the fifth factor is not relevant.
1. Predictability of Results
This factor addresses "whether the choice of law was predictable before the time of the transaction or event giving rise to the cause of action ..." Nesladek v. Ford Motor Co., 46 F.3d 734, 738 (8th Cir. 1995) (applying Minnesota law). This factor is usually "not of great importance" in tort cases because of the "unplanned nature" of accidents. Jepson, 513 N.W.2d at 470. Here, however, this factor may still tip in favor of applying Iowa law. This case is not an ordinary "accidental" tort case, like a car accident, but rather a negligence claim focusing on the decision-making conduct of Hy-Vee and its data security employees. All of Hy-Vee's relevant information security employees and decision-making are located in Iowa. It is predictable that Iowa law would apply.
2. Maintenance of the Interstate Order
Maintenance of interstate order is satisfied "as long as the state whose laws are purportedly in conflict has sufficient contacts with and interest in the facts and issues being litigated." Danielson v. Nat'l Supply Co., 670 N.W.2d 1, 8 (Minn. Ct. App. 2003) (citation omitted). If "a state has little or no contact with a case and nearly all of the significant contacts are with a sister state, the factor suggests that a state should not apply its own law to the dispute." Hughes v. Wal-Mart Stores, Inc., 250 F.3d 618, 620–21 (8th Cir. 2001) (internal quotations and citations omitted) (applying Leflar's factors).
This factor heavily favors Iowa law. Both parties are Iowa residents. All of GreenState's branches are in Iowa. GreenState incurred its financial costs replacing, reissuing, and reimbursing compromised payment cards in Iowa. It is not enough that Hy-Vee has approximately ten percent of its stores in Minnesota. Hy-Vee made its information security decisions in Iowa, and its information technology and security employees are all in Iowa. The actions and omissions by Hy-Vee giving rise to GreenState's claims – its data security decision-making and the actions of the information technology department – are based in Iowa.
3. Advancement of State Interests
The court evaluates the advancement of the forum's governmental interest by considering "the relative policy interests of the two states." Nesladek, 46 F.3d at 739 (quoting Lommen v. City of East Grand Forks, 522 N.W.2d 148, 152 (Minn. Ct. App. 1994) ). Although "a state has at least some interest in protecting nonresidents from tortious acts committed within the state," that "interest is only slight and does not support application of its law to the litigation." Hughes, 250 F.3d at 621. Moreover, there is not an important state interest furthered "by ensuring that nonresidents are compensated for injuries that occur in another state." Id. (emphasis omitted). As discussed above, GreenState is an Iowa resident whose injury occurred in Iowa. Minnesota's governmental interest in this tort action is not significantly furthered, and this factor weighs in favor of Iowa law.
In sum, Minnesota's choice of law inquiry favors the application of Iowa law. Accordingly, the court applies Iowa law, and, as detailed above, GreenState's PCSA and negligence claims must be dismissed.
D. Declaratory and Injunctive Relief Claim
GreenState's remaining claim is for declaratory and injunctive relief, premised on its dismissed negligence claims. Because the court dismissed GreenState's substantive claims, it also dismisses GreenState's claim for declaratory and injunctive relief. See Pickrell v. Sorin Grp. USA, Inc., 293 F. Supp. 3d 865, 869 (S.D. Iowa 2018) (citing Schilling v. Rogers, 363 U.S. 666, 677, 80 S.Ct. 1288, 4 L.Ed.2d 1478 (1960) ) (explaining that the Declaratory Judgment Act is not a cause of action without an underlying claim); Minn. Indus. Ventures, L.L.C. v. City of Roseville, No. 05-cv-2488, 2006 WL 763208, at *5 n.4 (D. Minn. Mar. 24, 2006) (citing Great–West Life & Annuity Ins. Co. v. Knudson, 534 U.S. 204, 211 n.1, 122 S.Ct. 708, 151 L.Ed.2d 635 (2002) ) (explaining dismissal of substantive claim eliminates request for injunctive relief because "an injunction is a remedy, not a cause of action.").
CONCLUSION
Accordingly, IT IS HEREBY ORDERED that:
1. The motion to dismiss [ECF No. 64] is granted; and
2. The action is dismissed with prejudice.