Customers Could Seek Costs of Mitigating Harm from Data Security Breach

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Customers of supermarket chain operator Hannaford could pursue claims for breach of implied contract and negligence under Maine law against Hannaford for failing to prevent a data security breach, the U.S. Court of Appeals in Boston has held.

The customers stated valid claims for damages based on the costs of replacing their credit and debit cards and of purchasing credit insurance after a breach resulted in the theft of an estimated 4.2 million debit and credit card numbers, expiration dates, PINs, and other personal information.

Mitigation Damages

The damages sought by the customers amounted to “mitigation damages,” the court said. These damages were reasonably foreseeable, and recovery for them had not been barred by Maine for policy reasons.

Under Maine common law, a plaintiff may recover for costs and harms incurred during a reasonable effort to mitigate its damages resulting from a defendant’s negligence, regardless of whether the harm is nonphysical. To recover mitigation damages, plaintiffs needed only show that the efforts to mitigate were reasonable and that those efforts constituted a legal injury, such as actual money lost, rather than time or effort expended.

The case involved a large-scale, sophisticated, apparently global criminal operation conducted over three months and the deliberate taking of credit and debit card information. There had been actual misuse of customer data by the thieves, the court noted. The data had been used to run up thousands of improper charges to customers’ accounts; the customers were subject to a real risk of financial loss, making their mitigation efforts reasonable.

By the time Hannaford had notified customers of the breach, over 1,800 fraudulent charges had been identified, and the customers could have reasonably expected that many more fraudulent charges would follow. The customers’ claims for identity theft insurance and replacement card fees involved actual financial losses from credit and debit card misuse. Such damages were recoverable in Maine under both tort law and contract law, according to the court.

The customers could not, however, recover damages for their claims for loss of reward points, loss of reward point earning opportunities, and fees for pre-authorization arrangements. These injuries were too attenuated from the data breach because they were incurred as a result of third parties’ unpredictable responses to the cancellation of the customers’ credit or debit cards, the court said.

Breach of Implied Contract

With regard to the customers’ claims for breach of an implied contract, the court determined that a jury could find that, in a grocery transaction in which a customer uses a debit or credit card, there was an implied contract that Hannaford would not use the credit card data for other people’s purchases, would not sell the data to others, and would take reasonable measures to protect the information.

A customer using a credit card in a commercial transaction intended to provide that data to the merchant only and did not expect the merchant to allow unauthorized third parties to access the data, the court said.

Breach of a Fiduciary Duty

The customers failed, however, to assert a claim for breach of a fiduciary duty. First, the customers did not have a “confidential relationship” with Hannaford that would give rise to a fiduciary duty, according to the court. The “trust and confidence” allegedly placed by the customers in Hannaford was not the type of trust and confidence contemplated by Maine’s common law. Such claims typically involved family relationships, joint ventures or partnerships, and lender/borrower relations in which one party had taken advantage of another for purposes of acquiring or using the other’s property or assets. No such relationship existed in this case.

Second, the grocery purchase relationship between the parties was not characterized by a disparity in bargaining positions. Hannaford did not have a monopoly on the sale of groceries and did not require the use of credit or debit cards.

Third, the customers failed to allege that Hannaford abused a position of trust, the court said. There was no suggestion in the complaint that Hannaford provided anything but a fair exchange in groceries in return for the customers’ payments or that Hannaford somehow took advantage of the system of allowing customers to use credit and debit cards.

Unfair Trade Practices

Hannaford’s failure to disclose the breach did not give rise to a cause of action under Maine’s Unfair Trade Practices Act, the court decided. The private remedies provision of the Act required that the plaintiff suffer a loss of money or property as a result of the defendant’s unlawful act. Maine’s highest court had interpreted the Act as only allowing private actions for “substantial” injuries. The private remedies provision was to be read narrowly, particularly when common-law actions for negligence and breach of implied contract were available.

The decision in Anderson v. Hannaford Brothers Co., appears at CCH Privacy Law in Marketing ¶60,687.

Motor Vehicle Dealer Not Damaged by Phase-Out of Oldsmobile Line

This posting was written by Pete Reap, Editor of CCH Business Franchise Guide.

A motor vehicle dealer's breach of contract claim against General Motors (GM) for phasing out its Oldsmobile line of vehicles necessarily failed because, as a result of the dealer's actions to mitigate its damages, it suffered no loss, the U.S. Court of Appeals in Richmond, Virginia, has held.

GM had entered into an agreement authorizing a dealer to operate an Oldsmobile dealership from November 2000 through October 2005. Only weeks later, GM announced its decision to terminate the Oldsmobile line, the court observed.

After being informed of the decision, the dealer, without consulting GM, purchased a nearby Nissan dealership in order to mitigate the anticipated loss of Oldsmobile sales. The dealer purchased the goodwill of the Nissan dealership for $1 million and entered into a Nissan dealership agreement that required it to separate its GM and Nissan facilities after a period of time.

In December 2001, the dealer informed GM of the dealership acquisition and the fact that the Oldsmobile dealership would be sharing the building with the Nissan operation for two years. Soon thereafter, GM sent the dealer a letter agreement, stating that the addition of the Nissan dealership without GM’s approval was a material breach of the dealership agreement.

Contract, Statutory Claims

In September 2005, the dealer filed an action against GM, alleging actual and anticipatory breach of the dealership agreement and violations of the West Virginia motor vehicle dealer law. The action initially claimed $2.47 million in “mitigation costs.”

The trial court dismissed the damage claim based on the fact that the dealer had profited from its mitigation. The dealer then added a claim for lost profits. An expert’s testimony on lost future profits, based on sales during a single baseline year, was excluded for failure to meet the standards of Federal Rule of Evidence 702, as clarified by Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579, and Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999). Because the dealer lacked any evidence of lost future profits, the trial court entered judgment as a matter of law in favor of GM.

On appeal, the dealer argued that it was entitled to the $1 million it paid for the goodwill for the Nissan dealership, the $526,641 it paid to separate the Nissan and Oldsmobile dealership facilities, plus $1,972,985 in lost profits during the remaining term of its Oldsmobile dealership, for a total claimed loss of $3,499,626.

Lack of Economic Loss

Through its efforts at purported mitigation, the dealer had acquired a Nissan dealership with a total value of $5 million by the end of the term of its Oldsmobile dealership agreement in 2006, according to the appeals court. The $5 million figure did not even take into account the dealer's profits from the sale of at least 2,000 Nissan vehicles.

Based on the dealer's own appraisal of the value of the Nissan dealership in 2006, the Nissan dealership's increase in value more than compensated the dealer for all of its alleged mitigation damages and lost profits. It was clear that the dealer suffered no economic loss and therefore no legally cognizable damage as a result of GM's alleged breach, the appeals court held.

West Virginia Dealer Law

GM did not violate the West Virginia motor vehicle dealer law by enforcing facility requirements that were "unreasonable considering current economic conditions" or "not otherwise justified by reasonable business considerations," the court determined. Under the agreement with GM, the dealer was required to obtain GM's prior written consent before it added the Nissan line, and the dealer failed to do so.

In addition, the dealer specifically agreed in its contract with Nissan, entered into over four months prior to GM's sending of the letter agreement, that it would maintain separate facilities for the Nissan dealership. Thus, the dealer could not claim the GM's insistence that GM and Nissan dealerships be separated within two years violated the statute, the court reasoned.

The unpublished decision is C&O Motors, Inc. v. General Motors Corp., CCH Business Franchise Guide ¶14,110.