The Seventh Circuit recently upheld the dismissal of a novel putative class action filed by financial institutions against grocer Schnuck Markets (“Schnucks”) based on the economic loss doctrine. Schnucks suffered a data breach that exposed nearly 2.5 million credit and debit cards over four months until the intrusion was discovered. Instead of being filed by the usual data breach class action featuring a putative class of customers, this case was filed by financial institutions seeking to recover financial losses they incurred — employee time to investigate, indemnification payments, lost interest and transaction fees — from indemnifying breach victims’ losses above and beyond the contractual remedies available under their credit card network agreements.
On appeal, the Seventh Circuit upheld the district court’s dismissal for failure to state a plausible claim under all asserted legal theories based on its predictions of how the applicable states —Illinois and Missouri — would treat the issues. Initially, the court envisioned that both states would generally use the “contracting parties paradigm” of the economic loss doctrine and noted that the banks had already entered into voluntary and complex liability sharing agreements when entering into the credit card payment network.
The court conducted a claim-by-claim analysis under each state’s law. On plaintiffs general negligence claims, the court found neither states’ exceptions to the economic loss doctrine applied. Furthermore, the court predicted that Illinois would follow prior state appellate authority refusing to recognize a duty to safeguard information and that Missouri courts would likely take notice that the state data privacy statute does not provide for the reimbursement liability sought here like some states’ laws do. Likewise, the court rejected the premise of a negligence per se claim because plaintiffs failed to show a statute had been violated — the threshold element for such a claim in both states.
The court quickly dispatched plaintiffs’ unjust enrichment, implied contract, and third-party beneficiary claims under basic contract law principles. Both states’ laws reject unjust enrichment and implied contract claims where contracts govern the parties’ relationship and refuse to recognize third-party beneficiary claims absent an identified beneficiary or clearly documented third-party benefit.
Finally, the court assessed plaintiffs’ statutory claims and held that plaintiffs’ general allegation that deliberately concealing the data breach manipulated prices and sales volume was not cognizable as an unfair practice because Illinois courts have rejected the “market theory” of causation and plaintiffs did not plead any specific misrepresentations. While a violation of the state’s personal information protection law could be such a predicate act, plaintiffs failed to offer any legal argument on this point and the court declined to do so on the plaintiffs’ behalf.
Cmty. Bank of Trenton v. Schnuck Mkts., Inc., No. 17-2146 (7th Cir. Apr. 11, 2018).
