In Cumis, unauthorized parties gained access to data from millions of debit and credit cards used to purchase merchandise from a retailer, and used those cards to engage in fraudulent transactions. Credit unions that had issued the cards sued the retailer and its acquiring bank (the bank that processed the card transactions) for breach of contract as third party beneficiaries, negligence, fraud, and negligent misrepresentation. The trial court granted dismissal of the breach of contract and negligence claims. Following discovery, the trial court dismissed the remaining claims on summary judgment, and the credit unions appealed.
The Supreme Judicial Court of Massachusetts upheld the lower court’s decision on summary judgment. First it addressed the breach of contract claims, which were based on the argument that the credit unions were intended third-party beneficiaries of a contract between the retailer and the acquiring bank which required the defendants to refrain from storing debit and credit card data. Noting that the contract in question, by its express terms, forbids third-party enforcement, the court upheld the dismissal.
Next the court upheld the dismissal of the negligence claims, explaining that the economic loss doctrine, as applied in Massachusetts, prohibits tort recovery in the absence of physical harm or property damage.
Finally, the court upheld the dismissal on summary judgment of the fraud and negligent misrepresentation claims. Both claims were predicated on the allegation that in accepting credit cards for transactions the defendants were representing that they were in compliance with regulations established by the card brands (Visa and MasterCard), and that the credit unions relied on those representations. The court decided that the plaintiffs could not show that such alleged reliance had been justifiable.
To obtain a copy of the Cumis decision, please click here and enter “12/11/2009” as the release date.
