Sovereign Bank v. Bj's Wholesale Club, Inc.

533 F.3d 162 (3rd Cir. 2008)

Facts

Sovereign Bank (P) and the Pennsylvania State Employees Credit Union (P)(PSECU) are both members of the Visa network. Ps can issue Visa cards to their respective customers and members. Ps are referred to as 'Issuers.' Fifth Third Bank is referred to as an 'Acquirer,' which means that Fifth Third enters into contractual relationships with businesses that agree to accept Visa cards as payment for their goods and services. Acquirers process those transactions on behalf of the Merchants. BJ's Wholesale Club, Inc. (D), is a Merchant. Accordingly, Fifth Third and D have entered into a Merchant Agreement. Although Merchants participate in the Visa network, they are not members. Only financial institutions are eligible for membership. Merchants have no contractual relationship directly with Visa. Visa has created an extensive set of 'Operating Regulations' to both govern and facilitate transactions involving Visa cards. The Cardholder Information Security Program (CISP) apply to Issuers and Acquirers and include broad security requirements intended to protect Cardholder Information. They prohibit retaining or storing the data encoded in the familiar magnetic stripe on the back of credit cards after a consumer transaction is completed. The agreements allow Visa to take specified remedial actions against Members who do not comply with the Operating Regulations, including levying fines and penalties. The Operating Regulations give Visa, and only Visa, the right to interpret and enforce the Operating Regulations, and only Visa can determine whether a violation of the Operating Regulations has occurred. The Operating Regulations requires Issuers and Acquirers to ensure that their agents, service providers and Merchants comply with the Operating Regulations. The Operating Regulations also include 'Compliance' provisions that apply when a Member's violation of a Regulation causes a financial loss to another Member who cannot be made whole by resorting to chargeback or representment. An Issuer may use Compliance proceedings to shift a loss to the Acquirer if it resulted from the Acquirer's violation of an Operating Regulation. The Compliance provisions do not eliminate any rights a Member may have to pursue any legal remedies that may otherwise be available. An Acquirer must agree to ensure continued compliance with the Operating Regulations. An Acquirer must have a Merchant Agreement with each of its Merchants. The Merchant Agreements may generally contain whatever extraneous provisions the Acquirer and Merchant agree upon, but, the Agreement must, at a minimum, contain the provisions of Section 5.2 of the Operating Regulations. A security breach occurred and it was traced to the cards used at various BJ's stores. P responded by canceling some Visa cards and issuing new Visa cards to the affected cardholders. P looked blamed the breach on D's failure to comply with the requirements of § 5.2.h.3.b. and that Fifth Third (D) failed to comply with the Operating Regulations by failing to ensure that D complied with § 5.2.h.3.b. PSECU also canceled approximately 20,000 Visa cards that it had issued to its members who had used the cards at D. It then reissued Visa cards with new account numbers and new Cardholder Information at a cost of approximately $98,000. Ps sued Ds for negligence, breach of contract, and equitable indemnification. Ds moved to dismiss the claims against them under 12(b)(6). The district court denied D's motion on the negligence claim but granted it on the breach of contract and equitable indemnification claims. The court granted Fifth Third's motion on the negligence and equitable indemnification claims but denied it on the breach of contract claim. Fifth Third moved for reconsideration. P's breach of contract claim is based on a third-party or intended beneficiary theory and depends, in part, upon whether Fifth Third and Visa intended to give P enforceable rights under their separate contract even though Sovereign is not a party to it. The district court eventually dismissed all claims against D and dismissed all claims against Fifth Third except the breach of contract claim. The court granted summary judgment in favor of Fifth Third on the third-party beneficiary claim, holding that P was not an intended beneficiary of the Visa-Fifth Third Member Agreement. P appealed.