Opinion
CIVIL ACTION NO. 1:19-cv-04129-AT
09-30-2020
Eric SLAWIN, Plaintiff, v. BANK OF AMERICA MERCHANT SERVICES, Bank of America Corporation, First Data Corporation, Fiserv, Inc., Defendants.
Jean Simonoff Marx, Marx & Marx, LLC, Suite 500, 1050 Crown Pointe Pkwy., Atlanta, GA 30338, 404-261-9559, Email: lawyers@marxlawgroup.com, Robert Nathan Marx, Marx & Marx, LLC, Suite 500, 1050 Crown Pointe Pkwy., Atlanta, GA 30338, 404-261-9559, Email: lawyers@marxlawgroup.com, for Plaintiff Eric Slawin. Elena D. Marcuss, McGuire Woods, LLP, Suite 1000, Seven Saint Paul Street, Baltimore, MD 21202, 410-659-4454, Fax: 410-659-4547, Meredith Laughlin Allen, McGuire Woods LLP-GA, 1230 Peachtree Street, N.E., Promenade, Suite 2100, Atlanta, GA 30309-3534, 404-443-5738, Fax: 404-443-5773, Email: mlallen@mcguirewoods.com, for Defendant Bank of America Merchant Services Joseph D. Magrisso, Morgan Lewis & Bockius-FL, 200 South Biscayne Boulevard, Suite 5300, Miami, FL 33131-2339, 305-415-3424, Email: joseph.magrisso@morganlewis.com, Mark E. Zelek, Morgan Lewis & Bockius-FL, 200 South Biscayne Boulevard, Suite 5300, Miami, FL 33131-2339, 305-415-3303, Email: mzelek@morganlewis.com, Charles Edward Solley, Moser Law Co., The Stove Works, 691 John Wesley Dobbs Ave NE, Suite D-212, Atlanta, GA 30312, 404-537-5336, Email: tsolley@moserlawco.com, for Defendant, Bank of America Corporation. Christopher Paul Galanek, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6600, Email: chris.galanek@bclplaw.com, Aiten Musaeva McPherson, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6716, Email: aiten.mcpherson@bclplaw.com, for Defendant, First Data Corporation. Christopher Paul Galanek, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6600, Email: chris.galanek@bclplaw.com, Aiten Musaeva McPherson, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6716, Email: aiten.mcpherson@bclplaw.com, for Defendant Fiserv, Inc.
Jean Simonoff Marx, Marx & Marx, LLC, Suite 500, 1050 Crown Pointe Pkwy., Atlanta, GA 30338, 404-261-9559, Email: lawyers@marxlawgroup.com, Robert Nathan Marx, Marx & Marx, LLC, Suite 500, 1050 Crown Pointe Pkwy., Atlanta, GA 30338, 404-261-9559, Email: lawyers@marxlawgroup.com, for Plaintiff Eric Slawin.
Elena D. Marcuss, McGuire Woods, LLP, Suite 1000, Seven Saint Paul Street, Baltimore, MD 21202, 410-659-4454, Fax: 410-659-4547, Meredith Laughlin Allen, McGuire Woods LLP-GA, 1230 Peachtree Street, N.E., Promenade, Suite 2100, Atlanta, GA 30309-3534, 404-443-5738, Fax: 404-443-5773, Email: mlallen@mcguirewoods.com, for Defendant Bank of America Merchant Services
Joseph D. Magrisso, Morgan Lewis & Bockius-FL, 200 South Biscayne Boulevard, Suite 5300, Miami, FL 33131-2339, 305-415-3424, Email: joseph.magrisso@morganlewis.com, Mark E. Zelek, Morgan Lewis & Bockius-FL, 200 South Biscayne Boulevard, Suite 5300, Miami, FL 33131-2339, 305-415-3303, Email: mzelek@morganlewis.com, Charles Edward Solley, Moser Law Co., The Stove Works, 691 John Wesley Dobbs Ave NE, Suite D-212, Atlanta, GA 30312, 404-537-5336, Email: tsolley@moserlawco.com, for Defendant, Bank of America Corporation.
Christopher Paul Galanek, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6600, Email: chris.galanek@bclplaw.com, Aiten Musaeva McPherson, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6716, Email: aiten.mcpherson@bclplaw.com, for Defendant, First Data Corporation.
Christopher Paul Galanek, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6600, Email: chris.galanek@bclplaw.com, Aiten Musaeva McPherson, Bryan Cave Leighton Paisner LLP - ATL, One Atlantic Center, 14th Floor, 1201 West Peachtree St., N.W., Atlanta, GA 30309-3471, 404-572-6716, Email: aiten.mcpherson@bclplaw.com, for Defendant Fiserv, Inc.
ORDER
Amy Totenberg, United States District Judge
The following motions are pending before the Court:
(1) Motion to Dismiss [Doc. 4 ], filed by Defendants First Data Corporation ("FDC") and Fiserv, Inc. ("Fiserv");
(2) Motion to Dismiss [Doc. 6 ], filed by Defendant Bank of America Corporation ("BOA"); and
(3) Motion to Dismiss Counts II and III [Doc. 8 ], filed by Defendant Bank of America Merchant Services ("BAMS").
BAMS states that it "is incorrectly identified by its trade name, ‘Bank of America Merchant Services’ in the Complaint," instead of as Banc of America Merchant Services, LLC.
BAMS states that it "is incorrectly identified by its trade name, ‘Bank of America Merchant Services’ in the Complaint," instead of as Banc of America Merchant Services, LLC.
The court provides this statement of facts for background, taking well-pleaded allegations in the complaint as true and construing them in the light most favorable to the plaintiff. See Hill v. White , 321 F.3d 1334, 1335 (11th Cir. 2003).
This is a whistleblower case, brought under the Sarbanes-Oxley Act of 2002, 18 U.S.C. § 1514A, the Consumer Financial Protection Act of 2010, 12 U.S.C. § 5567 and the Dodd-Frank Wall Street Reform and Consumer Protection Act, 15 U.S.C. § 78u-6. Plaintiff Eric Slawin accuses his former employer BAMS, a company which provided payment processing services to companies such as Home Depot, Target, Amazon, ExxonMobile, Royal Caribbean Lines, MGM and others, as well as to municipalities, of failing to handle consumers’ Primary Account Number, or "PAN," data, in compliance with of Payment Card Industry, or "PCI" standards. (Compl. ¶ 1, 25.) Mr. Slawin alleges that BAMS knowingly misled its customers into believing its handling of PAN data met PCI standards, and that he was fired after raising concerns regarding these deceptive practices with his superiors. (Id. ¶ 1.)
Mr. Slawin was formerly a Vice President and Operations Control Officer at BAMS whose job was "to evaluate and assess compliance issues at BAMS, evaluate and assess risk for BAMS, and to develop and propose measures to mitigate identified risks." (Compl. ¶ 1.) BAMS was a joint venture between FDC (which is now a wholly-owned subsidiary of Fiserv) and BOA. (Id. ¶¶ 1, 8.) Both Fiserv and BOA are publicly-traded companies. (Id. ¶¶ 10, 14.) BAMS, together with its parent, BOA, enters into agreements to provide payment processing services to its merchant customers. (Id. ¶¶ 25–27.) Under these "Merchant Processing Agreements," BAMS and "BOA through its affiliate, Bank of America, N.A. are the ‘Servicer’ providing to its customers, including retail merchants and municipalities, processing services regarding credit, debit and other delineated card transactions and service." (Id. ¶ 28.) "BAMS and BOA warrant under these Merchant Processing Agreements that they are operating in compliance with ‘Card Organization Rules’ which agreements specifically state includes rules promulgated by the Payment Card Industry Security Standards Council." (Id. ¶ 30.)
Fiserv entered into a merger agreement to acquire FDC in an all-stock transaction in January of 2019. (Compl. ¶ 11.) At all times relevant to the Complaint, FDC was a publicly traded company. (Id. ¶ 9.)
It appears that the joint venture ended in June 2020. Patrick Thomas, Bank of America, First Data End Payments Partnership , Wall St. J. (July 29, 2019), https://www.wsj.com/articles/bank-of-america-first-data-end-payments-partnership-11564438374 ("Despite the end of the partnership, Bank of America and First Data agreed for products and services to continue being provided for Banc of America Merchant Services clients through at least June 2023 ....").
BAMS was the "face" of the business, and handled sales and leasing of point-of-sale equipment to merchants, as wells customer service, while FDC processed the transactions in the back end. (Id. ¶¶ 34–35.) FDC was PCI compliant. (Id. ¶ 37.) However, BAMS was not (Id. ¶ 47.) This was not an issue for typical credit or debit card transactions, as these were handled by FDC through FDC terminals. (Id. ¶ 36.) However, BAMS was the point of contact for refunds and chargebacks, which required it to obtain, utilize, store, and convey PAN data. (Id. ¶ 38–39.)
Mr. Slawin contends that on or around May 2017, BAMS executives were discussing the issue of BAMS being non-PCI complaint with respect to PAN data. (Id. ¶ 48.) He contends that these discussions also "reflect the decision among BAMS’ management that it was too costly for BAMS to become PCI complaint, and therefore that it would not become PCI compliant." (Id. ¶ 52.) Mr. Slawin raised concerns about how BAMS would respond to inquiries by potential and existing customers. (Id. ¶ 64.) He repeatedly expressed his concern that BAMS "was engaging in fraud by not disclosing its non-PCI compliance, instead misleading its potential and existing customers into believing that it was PCI compliant by having First Data (which was PCI compliant) answer those questions." (Id. ¶ 66.)
"Mr. Slawin was particularly concerned about BAMS’ PCI noncompliance because of the seriousness of data security and risk to BAMS’ customers’ and their customers in light of such risk," which included "BAMS’ exposure to large fines." (Id. ¶ 94.) Aside from that exposure, the purported fraud regarding PCI compliance "implicated mail and wire fraud issues," as BAMS advertised its PCI compliance as part of its customer solicitation efforts (Id. ) In addition, Mr. Slawin was concerned about SEC fraud as well as fraud upon shareholders because FDC and BOA included BAMS’ financial information in their SEC reports. (Id. )
In July of 2017, Mr. Slawin began downloading emails to his personal email account regarding the BAMS’ PCI non-compliance issue out of "concern[ ] about being drawn into fraudulent and improper data security practices" as well as "his intent to go to the SEC." (Id. ¶ 100.) On December 8, 2017, Mr. Slawin was approached by HR concerning these emails, and was asked to destroy the emails and certify that he had done so. He refused on December 11, and was terminated on December 12, 2017. (Id. ¶¶ 104, 105.)
The same day, December 12, 2017, he electronically filed a whistleblower complaint with the SEC. (Id. ¶ 106.) He also filed a whistleblower complaint with OSHA, later amending that complaint on April 27, 2018. (Id. ¶¶ 3, 4.) The Secretary of Labor had not taken any action after more than 180 following his amended complaint, and OSHA administratively closed its file to allow Mr. Slawin to bring this action. (Id. ¶ 5.)
II. Legal Standard
This Court may dismiss a pleading for "failure to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). A pleading fails to state a claim if it does not contain allegations that support recovery under any recognizable legal theory. 5 Charles Alan Wright & Arthur R. Miller, Federal Practice & Procedure § 1216 (3d ed. 2002) ; see also Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). Generally, notice pleading is all that is required for a valid complaint. See Lombard's, Inc. v. Prince Mfg., Inc. , 753 F.2d 974, 975 (11th Cir. 1985), cert. denied , 474 U.S. 1082, 106 S.Ct. 851, 88 L.Ed.2d 892 (1986). Under notice pleading, the plaintiff need only give the defendant fair notice of the plaintiff's claim and the grounds upon which it rests. See Erickson v. Pardus , 551 U.S. 89, 93, 127 S.Ct. 2197, 167 L.Ed.2d 1081 (2007) (citing Bell Atlantic v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). In ruling on a motion to dismiss, the court must accept the facts pleaded in the complaint as true and construe them in the light most favorable to the plaintiff. See Hill v. White , 321 F.3d 1334, 1335 (11th Cir. 2003) ; see also Sanjuan v. American Bd. of Psychiatry and Neurology, Inc. , 40 F.3d 247, 251 (7th Cir. 1994) (noting that at the pleading stage, the plaintiff "receives the benefit of imagination").
A complaint should be dismissed under Rule 12(b)(6) only where it appears that the facts alleged fail to state a "plausible" claim for relief. Bell Atlantic v. Twombly , 550 U.S. 544, 555-556, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ; Fed. R. Civ. P. 12(b)(6). A complaint may survive a motion to dismiss for failure to state a claim, however, even if it is "improbable" that a plaintiff would be able to prove those facts and even if the possibility of recovery is extremely "remote and unlikely." Twombly , 550 U.S. at 556, 127 S.Ct. 1955 (citations and quotations omitted). A claim is plausible where the plaintiff alleges factual content that "allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal , 556 U.S. at 678, 129 S.Ct. 1937. The plausibility standard requires that a plaintiff allege sufficient facts "to raise a reasonable expectation that discovery will reveal evidence" that supports the plaintiff's claim. Twombly , 550 U.S. at 556, 127 S.Ct. 1955. A Plaintiff is not required to provide "detailed factual allegations" to survive dismissal, but the "obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Id. at 555, 127 S.Ct. 1955.
III. Discussion
Plaintiff raises whistleblower retaliation claims under Sarbanes-Oxley Act, 18 U.S.C. § 1514A ("SOX") (Count I), the Consumer Financial Protection Act, 12 U.S.C. § 5567 ("CFPA") (Count II), and Section 922(a) of the Dodd-Frank Wall Street Reform and Consumer Protection Act, 15 U.S.C. § 78u-6 ("Dodd-Frank") (Count III). BAMS seeks dismissal of Counts II and II against it, while BOA, FDC, and Fiserv each seek dismissal of all three Counts against them.
The elements of a prima facie case under each of the statutes are similar. "To assert a whistleblower claim under SOX, the Plaintiff ‘must show by a preponderance of the evidence that (1)[he] engaged in protected activity; (2) the employer knew of the protected activity; (3)[he] suffered an unfavorable personnel action; and (4) circumstances exist to suggest that the protected activity was a contributing factor to the unfavorable action.’ " Bozeman v. Per-Se Techs., Inc. , 456 F. Supp. 2d 1282, 1358 (N.D. Ga. 2006) (quoting Collins v. Beazer Homes USA, Inc. , 334 F. Supp.2d 1365, 1375 (N.D. Ga. 2004) ) (alterations in original).
Likewise, to state a claim for retaliation under the CFPA, 12 U.S.C. § 5567, a plaintiff must establish "that (1) he engaged in protected activity; (2) the employer knew or suspected, either actually or constructively, that he engaged in the protected activity; (3) he suffered an unfavorable personnel or employment action; and (4) the protected activity was a contributing factor in the unfavorable action." Veard v. F & M Bank , 704 F. App'x 469, 473 (6th Cir. 2017) (internal quotation marks omitted).
Finally, "[t]o plead a valid claim for retaliation under Dodd-Frank, Plaintiff must allege that: (1) he engaged in protected activity; (2) he suffered a materially adverse employment action; and (3) there was a causal connection between the adverse action and the protected activity." Grimm v. Best Buy Co. , No. 16-1258, 2017 WL 9274874, at *4 (D. Minn. Apr. 19, 2017), report and recommendation adopted , No. 16-1258, 2017 WL 2345585 (D. Minn. May 30, 2017) ; see also Martensen v. Chicago Stock Exchange , 882 F.3d 744, 746 (7th Cir. 2018).
Defendants’ arguments for dismissal can be lumped into the following categories: (1) failure to exhaust remedies under SOX or CFPA, (2) failure to make a report to the SEC prior to his termination under Dodd-Frank, (3) failure to allege that the non-BAMS Defendants employed Mr. Slawin, (4) failure to show that non-BAMS Defendants knew of any protected conduct or took an adverse employment action, (5) failure to allege that Defendants are covered persons or service providers under the CFPA or that Mr. Slawin engaged in protected activity under that Act, and (6) as to the non-BAMS defendants, failure to demonstrate vicarious or successor liability.
(See Def. BOA's Br. Supp't Mot. to Dismiss at 4 ("BOA Br."), Doc. 6-1.) BOA also argues, for the first time in its Reply Brief, that Mr. Slawin does not allege that fraud was committed by a public company as required by SOX. Def. BOA's Reply Br. at 6 ("BOA Reply"), Doc. 35.) This argument was not raised in BOA's opening brief or any of the opening briefs of the other Defendants, and is therefore waived.
(See BOA Br. at 11; Def. BAMS's Br. Supp't Mot to Dismiss at 14 ("BAMS Br."), Doc. 8; Defs.’ FDC and Fiserv's Br. Supp't Mot. to Dismiss at 10 ("Fiserv Br."), Doc. 4.)
(See BOA Br. at 7; Fiserv Br. at 5.)
(See BOA Br. at 9; Fiserv Br. at 7.)
(See BAMS Br. at 5, 11; Fiserv Br. at 6); see also Defs. FDC and Fiserv's Reply Br. at 10 ("Fiserv's Reply Br. at 10 ("Fiserv Reply"), Doc. 34; BOA Reply at 13")
(See Fiserv Br. at 12; BOA Reply at 4, 7, 8, 10.)
A. Exhaustion of Administrative Remedies (SOX and CFPA)
First, BOA contains that Mr. Slawin did not exhaust his administrative remedies against the non-BAMS parties, because he failed to name them as respondents in the caption of his administrative complaint. Both the CFPA and SOX contain procedures for submitting whistleblower complaints to the Secretary of Labor (through OSHA) prior to bringing civil actions in district court.
The OSHA Amended Complaint is attached to BOA's Motion to Dismiss as Exhibit 1. (Doc. 6-2.) The Court may consider this attachment on a motion to dismiss because it was referenced in the Complaint and because exhaustion by filing the OSHA Amended Complaint is central to several of Plaintiff's claims. (E.g. , Compl. ¶ 3–6.) Brooks v. Blue Cross and Blue Shield of Florida, Inc. , 116 F.3d 1364 (11th Cir. 1997) ("[W]here the plaintiff refers to certain documents in the complaint and those documents are central to the plaintiff's claim, then the Court may consider the documents part of the pleadings for purposes of Rule 12(b)(6) dismissal, and the defendant's attaching such documents to the motion to dismiss will not require conversion of the motion into a motion for summary judgment.").
1. Statutory Background and Administrative History
Section 1514A of SOX provides the following:
(b) Enforcement Action.-- (1) In general.--A person who alleges discharge or other discrimination by any person in violation of subsection (a) may seek relief under subsection (c), by
(A) filing a complaint with the Secretary of Labor; or
(B) if the Secretary has not issued a final decision within 180 days of the filing of the complaint and there is no showing that such delay is due to the bad faith of the claimant, bringing an action at law or equity for de novo review in the appropriate district court of the United States, which shall have jurisdiction over such an action without regard to the amount in controversy.
This provision has been held to impose an administrative exhaustion requirement. Digital Realty Tr., Inc. v. Somers , ––– U.S. ––––, 138 S. Ct. 767, 773, 200 L.Ed.2d 15 (2018) ("To recover under § 1514A, an aggrieved employee must exhaust administrative remedies by ‘filing a complaint with the Secretary of Labor.’ "); see also Bozeman , 456 F. Supp. 2d at 1357 ("A federal court ‘can only conduct a de novo review of those [SOX whistleblower] claims that have been administratively exhausted.’ ") (quoting Willis v. Vie Financial Group, Inc. , No. 04-435, 2004 WL 1774575, at *6 (E.D. Pa. Aug. 6, 2004) ).
Similarly, the CFPA provides that
a person who believes that he or she has been discharged or otherwise discriminated against by any person in violation of subsection (a) may, not later than 180 days after the date on which such alleged violation occurs, file (or have any person file on his or her behalf) a complaint with the Secretary of Labor alleging such discharge or discrimination and identifying the person responsible for such act.
12 U.S.C. § 5567(c)(1)(A). Then,
[i]f the Secretary of Labor has not issued a final order within 210 days after the date of filing of a complaint under this subsection, or within 90 days after the date of receipt of a written determination, the complainant may bring an action at law or equity for de novo review in the appropriate district court of the United States having jurisdiction.
12 U.S.C. § 5567(c)(4)(D). While few courts have addressed whether this statute poses a jurisdictional administrative exhaustion requirement, Mr. Slawin does not contest that the CFPA, like SOX, contains an administrative exhaustion requirement, but instead contends that he has exhausted all of his administrative remedies as to BOA.
Mr. Slawin's OSHA Amended Complaint names Bank of America Merchant Services, LLC, as well as several individuals as respondents. (Doc. 6-2.) ("OSHA Complaint") Page 3 of the OSHA Complaint states that:
Respondent BAMS was established in 2009 as a Joint venture between Bank of America ("BOA") and First Data Corporation ("First Data") to provide payment processing services. BOA and First Data hive roughly equivalent ownership stakes in BAMS, with a third party investor owning a very small stake. BAMS is a subsidiary of First Data Corporation and is listed as such on First Data's SEC filings, including its most recent 10K filed with the SEC on February 21, 2018. First Data Corporation is a publicly traded company, BAMS is also denominated as an affiliate of BOA and included in BOA's financial reports filed with the SEC. BOA is a publicly traded company.
(Id. at 3.) Page 9 of the OSHA Complaint states that
Mr. Slawin was concerned about SEC fraud as well as fraud upon shareholders, as a result of BAMS’ financial status inclusion in BAMS’ parent company, First Data's reports filed with the SEC, as well as BOA's financial statements filed with the SEC in which BAM's [sic]
results were included on a consolidated basis.
(Id. at 9.) The Secretary of Labor did not issue a final decision within 210 days of his OSHA Complaint, and thereafter Mr. Slawin brought this action. 12 U.S.C. § 5567(c)(4)(D) ; 18 U.S.C. § 1514A(b)(2)(D).
2. Analysis of Exhaustion Issue
BOA contends that the reference to it in the OSHA Complaint as BAMS's parent is insufficient to exhaust remedies as to it. It points to OSHA's SOX regulations which define "respondent" in as "the person named in the complaint who is alleged to have violated the Act," and which require that the complainant allege the respondent's knowledge and that OSHA provide notice to the respondent. 29 C.F.R. §§ 1980.101(k), 1980.104(a), (b), (e), (f).
Fiserv and FDC, in footnote 3 of their Reply brief, incorporate by reference any argument made by any other Defendant, which "for consistency would require dismissal of the Complaint." (Fiserv Reply at 15 n. 3.)
It also cites to two cases from this circuit. First, BOA cites to a decision by Judge Vining in this district which held that, in the SOX context "the mere fact that [a defendant] is mentioned in the body of the OSHA complaint is insufficient" to exhaust administrative remedies. Bozeman v. Per-Se Techs., Inc. , 456 F. Supp. 2d 1282, 1358 (N.D. Ga. 2006).
Second, BOA cites to Smith v. Psychiatric Sols., Inc. , No. 3:08CV3/MCR/EMT, 2009 WL 903624, at *8 (N.D. Fla. Mar. 31, 2009), which found no exhaustion as to defendants who were not named "in the heading of [plaintiff's] administrative complaint or indeed anywhere in her complaint." The Eleventh Circuit affirmed in an unpublished decision, writing in a footnote that "Even if [plaintiff] had engaged in protected conduct, the district court was correct in dismissing her claim on the basis that Smith failed to exhaust her administrative remedies with respect to" those defendants. 358 Fed. Appx. 76, 78 (11th Cir. 2009).
In response, Mr. Slawin relies on Andrews et al. v. ING North America Insurance Corp. , No. 06-071, 2008 WL 4124111 (DOL Adm. Rev. Bd. Aug. 29, 2008). In that case, the Department of Labor's Administrative Review Board held that "SOX does not require a complainant to name a corporate respondent that [is itself covered under SOX] ... so long as the complainant names at least one respondent who is covered under the Act as an ‘officer, employee, contractor, subcontractor, or agent’ of such a company." Id. at *3.
SOX was amended in 2010 as part of the Dodd-Frank act to cover, in addition to officers, employees, agents, etc., "any subsidiary or affiliate whose financial information is included in the consolidated financial statements of such company." Pub.L. 111-203, § 922(b), (c), 124 Stat. 1848 (amending 18 U.S.C. § 1514A ).
Mr. Slawin also points to a California district court decision which rejected Judge Vining's conclusion in Bozeman and held that an opposing party need not be named as a respondent in an administrative complaint so long as the complaint provides the party " ‘fair notice’ of the charges against it." Wadler v. Bio-Rad Labs., Inc. , 141 F. Supp. 3d 1005, 1020 (N.D. Cal. 2015) (quoting Evans v. U.S. Envtl. Prot. Agency , 2012 WL 3164358, at *6 (DOL Adm. Rev. Bd., July 31, 2012) and citing Donovan v. Royal Logging Co. , 645 F.2d 822, 826 (9th Cir. 1981) ).
BOA attempts to distinguish Andrews and Wadler by noting that those cases involved allegations of wrongdoing by the entity not named as a respondent. (BOA Reply at 3–4.) BOA argues that the OSHA Complaint here "did not (1) identify BOA as a respondent, (2) accuse BOA of any violation, or (3) seek any relief from BOA." (BOA Reply at 2.) It further argues that Mr. Slawin does not allege that BOA had notice of his OSHA Complaint. (Id. at 3.)
If the Court were writing on a blank slate, it would find a certain appeal to the functionalist reasoning found in Mr. Slawin's cited cases. However, the Court must grapple with the persuasive effect of the Eleventh Circuit's Smith decision, which affirmed a district court's decision finding lack of exhaustion against defendants not named as respondents before OSHA. Smith is an unpublished decision, and the alternative and summary nature of the footnote on point renders the exhaustion determination arguably dicta. 358 Fed. Appx. at 78. Even so, the Court is reluctant to deviate from a clear decision of the Eleventh Circuit, albeit a nonbinding one, absent serious contrary persuasive authority which is not present here in light of BOA's efforts to distinguish Mr. Slawin's cases.
See 11th Cir. R. 36-2 ("Unpublished Opinions. An opinion shall be unpublished unless a majority of the panel decides to publish it. Unpublished opinions are not considered binding precedent, but they may be cited as persuasive authority.").
Mr. Slawin argues Smith is itself distinguishable, because unlike that case, BOA was at least mentioned in the OSHA Complaint in this case. Compare 2009 WL 903624, at *8 ("In the instant case, Smith did not name PBS or GCTC in the heading of her administrative complaint or indeed anywhere in her complaint.") (emphasis in original). However, the only references to BOA in the OSHA Complaint appear to be for the purpose of establishing that BAMS is subject to a SOX claim because it is "a subsidiary or affiliate whose financial information is included in the consolidated financial statements of" an entity covered by SOX. 18 U.S.C. § 1514A. Nowhere in the OSHA Complaint is BOA, or Fiserv for that matter, accused of any retaliatory action. While the Court does not read Smith as adopting a per se rule requiring naming a SOX defendant as a respondent in an administrative complaint to exhaust remedies as to that defendant, the few references to BOA and Fiserv in the OSHA Complaint do not materially distinguish this case from Smith. Moreover, while Smith involved SOX, and not the CFPA, Mr. Slawin does not set forth a reason why a different standard would apply under the similar statutory language, and as noted above, he concedes that an exhaustion requirement applies. Consequently, the Court finds that Counts I and II must be DISMISSED as to BOA, Fiserv, and FDC.
Mr. Slawin further argues that Smith is distinguishable because it was decided before the "2010 amendment to SOX that clarified that a parent corporation may be liable for the unlawful acts of its wholly owned subsidiary whose financial statements are incorporated into the consolidated financial statements of the parent corporation." (Pl.’s Resp. to BOA at 23, Doc. 30.) But the 2010 amendments merely clarified that subsidiaries and affiliates could themselves be liable under SOX under those circumstances. 18 U.S.C.A. § 1514A(a). BAMS, the respondent in the OSHA Complaint, has not moved to dismiss the SOX count on the grounds that it is not covered by SOX. (See generally , BAMS Br.)
B. Timeliness of SEC Complaint (Dodd-Frank)
All Defendants move to dismiss Count III on the grounds that Mr. Slawin was required to bring his Dodd-Frank whistleblower complaint prior to the challenged adverse employment action under the Supreme Court's decision in Digital Realty Tr., Inc. v. Somers , ––– U.S. ––––, 138 S. Ct. 767, 200 L.Ed.2d 15 (2018). Digital Realty held that a putative whistleblower who "did not provide information ‘to the [Securities and Exchange] Commission’ before his termination ... did not qualify as a ‘whistleblower’ at the time of the alleged retaliation" under Dodd-Frank. 138 S. Ct. at 778 (citing 15 U.S.C. § 78u–6(h) ("The term ‘whistleblower’ means any individual who provides ... information relating to a violation of the securities laws to the Commission, in a manner established, by rule or regulation, by the Commission.")).
Mr. Slawin attempts to distinguish Digital Realty on the grounds that Dodd-Frank's definition of "whistleblower" contains no requirement that information be provided to the SEC before termination, and argues that the plaintiff in Digital Realty did not file an SEC report at all. (Pl.’s Resp. to BOA Br. at 29–29, 29 n. 19). However, he points to no case law accepting this argument; in contrast, BOA cites the Fifth Circuit's contrary decision in Frye v. Anadarko Petroleum Corp. , 953 F.3d 285, 292–93 (5th Cir. 2019) and a host of district court decisions. (BOA. Br. at 15 n. 5) (collecting cases).
While this outcome may seem harsh, the Supreme Court recognized the possibility that, for example, "lawyers and auditors will face retaliation quickly, before they have a chance to report to the SEC," but pointed out that there was "nothing to show that Congress had this concern in mind when it enacted § 78u–6(h)." 138 S. Ct. at 780. ("Indeed, Congress may well have considered adequate the safeguards already afforded by Sarbanes–Oxley, protections specifically designed to shield lawyers, accountants, and similar professionals.")
Because Mr. Slawin was not a whistleblower under 15 U.S.C. § 78u-6(a)(6) at the time of the alleged retaliation, Count III of the Complaint (Dodd-Frank) must be DISMISSED as to all parties.
As this fully resolves all claims against the non-BAMS Defendants, the Court need not address whether Mr. Slawin failed to allege that non-BAMS Defendants employed Mr. Slawin or failed to show that non-BAMS Defendants knew of any protected conduct or took an adverse employment action. The Court also need not address whether the non-BAMS Defendants are vicariously liable for BAMS's conduct. Mr. Slawin has implied that BOA may be the successor by dissolution of BAMS pursuant to Fed. R. Civ. P. 25(c) and the Eleventh Circuit's decision in Virgo v. Riviera Beach Associates , 30 F.3d 1350, 1358 (11th Cir. 1994). The question of whether any of the non-BAMS parties is the successor to BAMS under applicable state law is distinct from the foregoing questions, and this Order is without prejudice to such arguments. However, Mr. Slawin has not filed a motion to substitute under that rule, and until such time, Rule 25 presumes that an action "may be continued by or against the original party." The Parties should confer about this matter as part of the scheduling conference and either agree upon substitution, or if they cannot, Mr. Slawin is authorized to file a motion under Rule 25(c) within 30 days of the date of entry of this Order.
If there is a need for discovery with respect to this issue, the Parties should address it in their forthcoming Joint Preliminary Report and Discovery Plan.
C. Consumer Financial Protection Act
BAMS next argues that Mr. Slawin fails to state a claim for retaliation under the CFPA because he failed to plausibly allege that BAMS is a covered person or service provider under that Act or that Mr. Slawin engaged in protected activity under the Act. The Court first addresses the argument that Mr. Slawin has not pled that BAMS is covered by the Act, and then the argument that he has not engaged in protected activity.
1. Covered Person or Service Provider
The whistleblower protection statute of the CFPA provides that "[n]o covered person or service provider shall terminate or in any other way discriminate against, or cause to be terminated or discriminated against, any covered employee ... by reason of the fact that such employee" has engaged in certain protected activities, discussed further below. 12 U.S.C. § 5567(a). The first question for the Court is whether BAMS is a covered person or service provider under the Act.
Mr. Slawin alleges that:
The Defendants are covered service providers employers within the meaning of the CFPA since they provide consumer financial products/services through their provision of credit card services and products within the meaning of the CFPA.
(Compl. ¶ 125). Mr. Slawin also alleges that "[a]s a payment processor, BAMS comes within the meaning of the Consumer Financial Protection Act, 12 U.S.C. § 5481(15)(A)(vii)." (Id. ¶ 22.)
The act has an extensive definition section. To ascertain whether BAMS is a covered person or service provider, there is no substitute for doing a deep dive into the definitions. Covered person is defined straightforwardly as:
(A) any person that engages in offering or providing a consumer financial product or service; and
(B) any affiliate of a person described in subparagraph (A) if such affiliate acts as a service provider to such person.
An affiliate is "any person that controls, is controlled by, or is under common control with another person." 12 U.S.C. § 5481(1).
An affiliate is "any person that controls, is controlled by, or is under common control with another person." 12 U.S.C. § 5481(1).
12 U.S.C. § 5481(6). Service provider, on the other hand, is defined quite cumbersomely as follows:
(A) In general
The term "service provider" means any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service, including a person that--
(i) participates in designing, operating, or maintaining the consumer financial product or service; or
(ii) processes transactions relating to the consumer financial product or service (other than unknowingly or incidentally transmitting or processing financial data in a manner that such data is undifferentiated from other types of data of the same form as the person transmits or processes).
(B) Exceptions
The term "service provider" does not include a person solely by virtue of such person offering or providing to a covered person--
(i) a support service of a type provided to businesses generally or a similar ministerial service; or
(ii) time or space for an advertisement for a consumer financial product or service through print, newspaper, or electronic media.
(C) Rule of construction
A person that is a service provider shall be deemed to be a covered person to the extent that such person engages in the
offering or provision of its own consumer financial product or service.
There is one last piece of the puzzle. "Covered persons" and "service providers" must respectively (i) offer or provide "a consumer financial product or service," or (ii) provide material support in connection with such product or service. "Consumer financial product or service" is defined as:
any financial product or service that is described in one or more categories under--
(A) paragraph (15) and is offered or provided for use by consumers primarily for personal, family, or household purposes; or
(B) clause (i), (iii), (ix), or (x) of paragraph (15)(A), and is delivered, offered, or provided in connection with a consumer financial product or service referred to in subparagraph (A).
12 U.S.C. § 5481(5). Paragraph (15), which is the definition of "financial product or service," is simply too extensive to legibly reproduce. Paragraph (15)(A) lists ten examples of financial services, with a safety valve for the CFPB to add more. Paragraph (B) contains a rule of construction limiting the consideration of certain activities by financial holding companies as "incidental or complementary" to an otherwise permissible financial activity. Paragraph (C) excludes from financial product or service "the business of insurance" and "electronic conduit services."
Mr. Slawin's Complaint alleges that BAMS engages in offering a consumer financial service by virtue of the fact that it is a payment processer, citing 12 U.S.C. § 5481(15)(A)(vii). Reader, this unfortunately portends another block quote:
The term "financial product or service" means-- ...
(vii) providing payments or other financial data processing products or services to a consumer by any technological means, including processing or storing financial or banking data for any payment instrument, or through any payments systems or network used for processing payments data, including payments made through an online banking system or mobile telecommunications network, except that a person shall not be deemed to be a covered person with respect to financial data processing solely because the person--
(I) is a merchant, retailer, or seller of any nonfinancial good or service who engages in financial data processing by transmitting or storing payments data about a consumer exclusively for purpose of initiating payments instructions by the consumer to pay such person for the purchase of, or to complete a commercial transaction for, such nonfinancial good or service sold directly by such person to the consumer; or
(II) provides access to a host server to a person for purposes of enabling that person to establish and maintain a website;
The Complaint alleges that that "BAMS provides payment processing services to major private merchants such as Home Depot, Target, Amazon, Exon [sic] Mobile, Royal Caribbean Lines, MGM and others, as well as to numerous municipalities, to facilitate credit and debit card transactions between those entities and their customers," and that "[w]hen a retail merchant or municipality processes credit or debit card transactions, those transactions are handled through First Data, using First Data's terminals which BAMS has sold to its customers." (Compl. ¶ 25.) Mr. Slawin thus alleges he has adequately alleged that BAMS provides a financial product or service, namely providing "payment[ ] ... processing products or services to a consumer by any technological means, including processing or storing financial or banking data for any payment instrument, or through any payments systems or network used for processing payments data." 12 U.S.C. § 5481(15)(A)(vii).
BAMS does not appear to contest that it provides payment processing services or that payment processing is a financial service in the abstract, but contends that it nonetheless does not provide a "consumer financial product or service" and thus is not a "covered person" because, as acknowledged in the Complaint, its customers are merchants and municipalities, not consumers. 12 U.S.C. § 5481(15)(A)(vii) ("The term "financial product or service" [includes] ... providing payments or other financial data processing products or services to a consumer ....") (emphasis added); see also id. § 5481(5) (defining "a consumer financial product or service" as "any financial product or service that is described in one or more categories under-- (A) paragraph (15) and is offered or provided for use by consumers primarily for personal, family, or household purposes.") (emphasis added).
Ultimately, BAMS’ reliance on its "customers" is a red herring. The statute refers to "providing" payment processing services to consumers, not "selling" or "charging for" such services. In today's economy, consumers often expect to receive services, such as paying by credit card instead of cash, without paying extra for such services. The implication is that another entity, such as a merchant, has contracted with the service provider to pay for the service. Were the court to accept BAMS’ reading, it would appear the statute would only cover offering of payment processing services directly to consumers for use by those consumers primarily for personal, family, or household purposes, ostensibly for such crucial engagements as paying a child's allowance by credit card.
BAMS provided payment processing services to companies such as "Home Depot, Target, Amazon, Exon [sic] Mobile, Royal Caribbean Lines, MGM and others," which plausibly entailed processing payments from consumers to those companies for making purchases primarily for personal, family, or household purposes. BAMS is therefore engaged in providing a consumer financial service and is thus a covered person. The Court therefore need not reach the question of whether it is also a service provider. 2. Protected Conduct
BAMS relies heavily on Judge Story's decision in Consumer Fin. Prot. Bureau v. Universal Debt & Payment Sols., LLC , 1:15-CV-00859-RWS, 2015 WL 11439178 (N.D. Ga. Sept. 1, 2015) for its argument that payment processors which provide services to businesses are not covered persons. It writes that the court in Universal Debt "said that the [Payment Processor] Movants were not ‘covered persons’ because, like BAMS, they provided no services ‘to consumers’ but instead served only the debt-collection businesses." (BAMS Reply at 5) (citing 2015 WL 11439178, at *15 ). The Court disagrees with BAMS's interpretation of Judge Story's Order. The cited paragraph, in context, shows that Judge Story did not reach the issue at all, because the payment processors were service providers:
The Payment Processors contend they did not offer their services to consumers but to merchants (and/or to Global, in the case of the ISOs). Nor are they affiliates of covered persons. In the paragraphs of the Complaint where the CFPB alleges Global Payments is a covered person and a service provider, it does not allege Global provides financial services to consumers, only to the Debt Collectors. (Compl., Dkt. [1] ¶ 77.) The same is true for Pathfinder and Frontline. (Id. ¶¶ 81, 85.) But, even if the Payment Processors are not covered persons, they could still be subject to liability for unfair acts or practices if they are service providers. See 12 U.S.C. § 5536(a). As explained below, they are.
2015 WL 11439178, at *15.
--------
As the Court noted above, the CFPA protects whistleblowers who engage in certain protected activity from adverse employment actions. The Act protects any covered employee who
(1) provided, caused to be provided, or is about to provide or cause to be provided, information to the employer, the Bureau, or any other State, local, or Federal, government authority or law enforcement agency relating to any violation of, or any act or omission that the employee reasonably believes to be a violation of, any provision of this title or any other provision of law that is subject to the jurisdiction of the Bureau, or any rule, order, standard, or prohibition prescribed by the Bureau;
(2) testified or will testify in any proceeding resulting from the administration or enforcement of any provision of this title or any other provision of law that is subject to the jurisdiction of the Bureau, or any rule, order, standard, or prohibition prescribed by the Bureau;
(3) filed, instituted, or caused to be filed or instituted any proceeding under any Federal consumer financial law; or
(4) objected to, or refused to participate in, any activity, policy, practice, or assigned task that the employee (or other such person) reasonably believed to be in violation of any law, rule, order, standard, or prohibition, subject to the jurisdiction of, or enforceable by, the Bureau.
12 U.S.C. § 5567(a). Most relevant to present purposes are (1) and (4), which refer to reporting or objecting to any activity that the employee "reasonably believed" to be a violation of "any law, rule, order, standard, or prohibition, subject to the jurisdiction of, or enforceable by, the Bureau." Id.
The Complaint alleges that "Mr. Slawin ... believed that BAMS’ non-PCI compliance and fraudulent misrepresentations to its customers regarding credit/debit card data security violated laws enforced by the Consumer Financial Protection Bureau covering consumer credit and electronic financial transactions," and that he "had a good faith belief that BAMS’ non-PCI compliance and fraudulent conduct related to its refusal to be PCI compliant violated laws subject to the jurisdiction of the Consumer Financial Protection Bureau including inter alia the CFPA and the Electronic Fund Transfer Act ( 15 U.S.C. 1693 et seq. ) ("EFTA")." (Id. ¶¶ 74, 130.)
BAMS contends that the reference to violations of the CFPA is conclusory and that the EFTA generally only applies to financial institutions, which BAMS is not. 12 C.F.R. § 1005.3 ("Generally, this part applies to financial institutions. For purposes of §§ 1005.3(b)(2) and (3), 1005.10(b), (d), and (e), 1005.13, and 1005.20, this part applies to any person, other than a person excluded from coverage of this part ...."). BAMS contends that Mr. Slawin's Complaint instead primarily references purported violations of laws outside the CFPB's jurisdiction. (E.g. Compl. ¶¶ 1 ("Mr. Slawin reasonably believed that BAMS’ deceptive practices regarding its being non-PCI compliant violated federal mail fraud, bank fraud, and wire fraud laws, as well as violated federal law regarding corporate financial disclosures."), 69 ("Mr. Slawin reasonably believed on an objective and subjective basis that BAMS’ deliberate strategy to mislead its merchant and municipal customers into erroneously believing that BAMS was PCI compliant violated federal laws against bank fraud, wire fraud, mail fraud, reporting requirements to the SEC, and violated the controls provisions in section 404 of the Sarbanes-Oxley Act of 2002.")).
There is not much case law on what level of detail must be pled to plausibly allege protected activity under the CFPA. The Court looks to decisions interpreting the similar protected activity provision found in SOX. 18 U.S.C.A. § 1514A(a) (prohibiting retaliation against employees who provide information "regarding any conduct which the employee reasonably believes constitutes a violation of section 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders."); see also Veard v. F & M Bank , 704 Fed. Appx. 469, 474 (6th Cir. 2017) (applying SOX standard to CFPA claim).
The Eleventh Circuit, in Gale v. U.S. Dep't of Labor , 384 Fed. Appx. 926, 929 (11th Cir. 2010), ruled that ‘reasonable belief’ "encompasses both a subjective and an objective component." "The subjective component is satisfied if a plaintiff actually believes the complained of conduct fits into one of the categories" of laws covered by the Act. Burns v. Medtronic, Inc. , 8:15-CV-2330-T17-TBM, 2016 WL 3769369, at *4 (M.D. Fla. July 12, 2016) (citing Rhinehimer v. U S. Bancorp Inv. , Inc., 787 F.3d 797, 811 (6th Cir. 2015) ) "The objective component is ‘evaluated based on the knowledge available to a reasonable person in the same factual circumstances with the same training and experience as the aggrieved employee.’ " Id. (citing Rhinehimer , 787 F.3d at 811 ); Livingston v. Wyeth, Inc. , 520 F.3d 344, 352 (4th Cir. 2008). "The question of objective reasonableness is amenable to disposition as a matter of law, but only when no reasonable person could believe there was conduct that fit into one of the listed categories." Id. (citing Rhinehimer , 787 F.3d at 811 ). Courts have rejected a requirement that a plaintiff's allegations must "definitively and specifically" relate to one of the enumerated categories of protection. Id. (citing Rhinehimer , 787 F.3d at 811 ).
Mr. Slawin alleges that he "believed that BAMS’ non-PCI compliance and fraudulent misrepresentations to its customers regarding credit/debit card data security violated laws enforced by the Consumer Financial Protection Bureau covering consumer credit and electronic financial transactions" and alleges that because "BAMS was not PCI compliant ... [cardholder] PAN data was at risk, potentially exposing BAMS, its merchant and municipal customers, and their customers [e.g., consumers] to millions of dollars [in] loss." (Compl. ¶¶ 1, 74.) Mr. Slawin argues that BAMS's alleged misrepresentation about PCI compliance would be subject to the jurisdiction of the CFPB as "an unfair, deceptive, or abusive act or practice ... in connection with a transaction with a consumer for a consumer financial product or service ... that ... causes or is likely to cause substantial injury to consumers ..." 12 U.S.C. § 5531.
Mr. Slawin bases this belief on substantial experience. He alleges that "[a]t the time of his employment by BAMS, Mr. Slawin had had almost 25 years in the Securities and Banking Regulatory and Compliance field, having started in this area in 1991." (Compl. ¶ 75.) Additionally, "[p]rior to working at BAMS Mr. Slawin had held numerous regulatory and compliance positions both for governmental regulatory agencies as well as for other banks." (Id. ) Taken as true, Plaintiff has plausibly alleged an objectively reasonable basis to belief BAMS’ actions violated laws or rules subject to CFPB jurisdiction. Accordingly, the motion to dismiss is DENIED as to Count II.
IV. Conclusion
For the above reasons:
• FDC and Fiserv's Motion to Dismiss [Doc. 4 ] is GRANTED ;
• BOA's Motion to Dismiss [Doc. 6 ] is GRANTED ; and
• BAMS's Motion to Dismiss Counts II and III [Doc. 8 ] is GRANTED as to Count III and DENIED as to Count II.
BAMS and Mr. Slawin are DIRECTED to file a Joint Preliminary Report and Discovery Plan (JPRDP) within fourteen days of the date of entry of this Order. In the event Mr. Slawin intends to pursue a Rule 25(c) motion, he is authorized to file it within 30 days from the date of entry of this Order.
IT IS SO ORDERED this 30th day of September, 2020.