Spec's Family Partners v. First Data Merchant Servs. ( 2019 )

NOT RECOMMENDED FOR FULL-TEXT PUBLICATION
File Name: 19a0294n.06
Case Nos. 17-5884/5950
UNITED STATES COURT OF APPEALS
FOR THE SIXTH CIRCUIT
FILED
Jun 07, 2019
SPEC’S FAMILY PARTNERS, LIMITED, ) DEBORAH S. HUNT, Clerk
)
Plaintiff-Appellee/Cross-Appellant, )
) ON APPEAL FROM THE UNITED
v. ) STATES DISTRICT COURT FOR
) THE WESTERN DISTRICT OF
FIRST DATA MERCHANT SERVICES LLC, ) TENNESSEE
)
Defendant-Appellant/Cross-Appellee. )
BEFORE: BATCHELDER, COOK, and KETHLEDGE, Circuit Judges.
COOK, Circuit Judge. Two attacks on Spec’s Family Partners’ payment card system led
to millions of dollars in damage-control costs, which the major credit card brands and their
associated bank passed on to First Data, the company processing payments for Spec’s. First Data
footed the bill and began withholding routine payments to Spec’s to make up the difference.
Spec’s sued. Interpreting the contract between the parties, the district court awarded judgment to
Spec’s. First Data appeals and Spec’s cross-appeals its interest awards. We AFFIRM in full.
I.
Spec’s Family Partners operates dozens of liquor stores across Texas. Like nearly all
retailers in today’s economy, Spec’s allows customers to purchase goods using payment cards
backed by companies like Visa and Mastercard. This situates Spec’s at the end of a string of
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
contractual relationships supporting the payment card system. The card brands contract with both
“issuing banks,” who issue cards, and “acquiring banks,” who sponsor merchants into the system
and process their transactions. Intermediary companies, like First Data, often contract with
acquiring banks to facilitate the processing of transactions from merchants.
In 2012 and 2013, Spec’s fell victim to attacks on its payment card network—the attackers
installed malware and accessed customer data. A later investigation revealed that Spec’s failed to
comply with the Payment Card Industry Data Security Standard (“PCI DSS”) prior to the attacks,
leaving it vulnerable to the breaches. The attacks sparked a cost-shifting reaction down the
payment card chain. After the issuing banks reimbursed defrauded cardholders and replaced cards,
Visa and Mastercard issued assessments on the acquiring bank, Citicorp Payment Services Inc., to
cover costs. Citicorp then demanded payment from First Data, which, in turn, sought
reimbursement from Spec’s.
First Data simultaneously began withholding the proceeds of routine payment card
transactions from Spec’s, placing them in a reserve account. But Spec’s ultimately refused to pay
First Data, relying on the consequential damages waiver in the “Merchant Agreement,” the
contract between the parties. When Spec’s filed suit, First Data had withheld approximately
$2.2 million (the total would eventually reach $6.2 million).
In denying the parties’ Rule 12 motions, the district court made two findings favorable to
Spec’s. See Fed. R. Civ. P. 12(b)(6), 12(c). First, it held that the card brand assessments
constituted consequential damages, thus barring liability for Spec’s under the Merchant
Agreement’s limitation clause. Second, it refused to treat the assessments as “third-party fees and
charges,” for which Spec’s retains liability under § 5 of the Merchant Agreement. The district
court later granted summary judgment in favor of Spec’s, holding that First Data materially
-2-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
breached the Merchant Agreement when it diverted funds to reimburse itself for the card brand
assessments.
Spec’s moved for entry of judgment and the district court ruled in its favor. It awarded
prejudgment interest at Tennessee’s statutory formula rate and postjudgment interest at 6.25%.
Later, however, the court granted First Data’s Rule 59(e) motion to amend and reduced the
postjudgment interest rate to 1.79%, reflecting a calculation under federal law, 28 U.S.C. § 1961,
rather than Tennessee’s statutory rate. First Data appeals the district court’s grant of summary
judgment in favor of Spec’s. For its part, Spec’s cross-appeals the court’s interest rate awards.
II.
We review de novo a grant of summary judgment. Upshaw v. Ford Motor Co., 576 F.3d
576, 584 (6th Cir. 2009). We also review a district court’s interpretation of a contract with fresh
eyes. See Ferro Corp. v. Garrison Indus., 142 F.3d 926, 931 (6th Cir. 1998). “The grant or denial
of a Rule 59(e) motion is within the informed discretion of the district court, reversible only for
abuse.” Huff v. Metro. Life Ins., Co., 675 F.2d 119, 122 (6th Cir. 1982). Tennessee contract law
governs the Merchant Agreement, R. 1-3, PageID 19, and thus the contract dispute here, see
Certified Restoration Dry Cleaning Network, L.L.C. v. Tenke Corp., 511 F.3d 535, 541 (6th Cir.
2007) (“When interpreting contracts in a diversity action, we generally enforce the parties’
contractual choice of forum and governing law.”).
A. Liability Under the Merchant Agreement
In a contract dispute, the court’s “task is to ascertain the intention of the parties based upon
the usual, natural, and ordinary meaning of the contractual language.” Planters Gin Co. v. Fed.
Compress & Warehouse Co., 78 S.W.3d 885, 889–90 (Tenn. 2002). “If the contract is
unambiguous, then the court should not go beyond its four corners to ascertain the parties’
-3-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
intention,” Adkins v. Bluegrass Estates, Inc., 360 S.W.3d 404, 412 (Tenn. Ct. App. 2011), because
the “literal meaning controls the outcome of the dispute,” Allstate Ins. Co. v. Watson, 195 S.W.3d
609, 611 (Tenn. 2006). “‘Only if ambiguity remains after the court applies the pertinent rules of
construction does the legal meaning of the contract become a question of fact’ appropriate for a
jury.” Planters Gin, 78 S.W.3d at 890 (quoting Smith v. Seaboard Coast Line R.R. Co., 639 F.2d
1235, 1239 (5th Cir. 1981)).
First Data asserts, contrary to the district court’s findings, that the Merchant Agreement
makes Spec’s liable for the card brand assessments. It first argues that Spec’s retains liability for
the assessments under the contract’s indemnification clause, despite the agreement’s limitation on
that clause. It further contends that the assessments constitute “third-party fees and charges” under
§ 5 of the agreement. We find both arguments unpersuasive.
The indemnification and limitation clauses. First Data emphasizes the obligations that the
contract’s indemnification clause, § 15, assigns Spec’s. Section 15(b) states, in relevant part, that
Spec’s must indemnify First Data, Visa, and Mastercard, and hold them harmless from and against:
any and all claims, demands, losses, costs, liabilities, damages, judgments, or
expenses arising out of or relating to (i) any material breach by [Spec’s] of its
representations, warranties, or agreements under this Agreement; [or] (ii) any act
or omission by [Spec’s] that violates . . . any operating rules or regulations of Visa
or Mastercard . . . .
R. 1-3, PageID 20. Two subsections later, however, on the same page, § 15(d) announces a
conspicuous limitation:
IN NO EVENT SHALL EITHER PARTY’S LIABILITY OF ANY KIND TO THE
OTHER HEREUNDER INCLUDE ANY SPECIAL, INDIRECT, INCIDENTAL,
OR CONSEQUENTIAL LOSSES OR DAMAGES, EVEN IF SUCH PARTY
SHALL HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
POTENTIAL LOSS OR DAMAGE.
Id.
-4-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
The dispute between the parties boils down to whether the card brand assessments passed
down to First Data constituted consequential damages, thus exempting Spec’s from liability. The
district court held that they did, and we agree.
General and consequential damages “are constituent elements of compensatory damages
which are awarded to make [the non-breaching party] whole or to compensate him for the loss he
has sustained because of . . . wrongful conduct.” Inland Container Corp. v. March, 529 S.W.2d
43, 44 (Tenn. 1975), abrogated on other grounds by Hodges v. S.C. Toof & Co., 833 S.W.2d 896
(Tenn. 1992). Consequential damages, which Tennessee courts also refer to as “special damages,”
see, e.g., Turner v. Benson, 672 S.W.2d 752, 754–55 (Tenn. 1984), “are such as are the natural
consequences of the act complained of, though not the necessary results,” Burson v. Cox, 65 Tenn.
360, 362 (1873) (emphasis added), cited with approval in Burris v. State, No. 88-272-II, 1988 WL
129763, at *3 (Tenn. Ct. App. Dec. 7, 1988); see also Mitchell v. Mitchell, 876 S.W.2d 830, 831
(Tenn. 1994) (quoting Lance Prods., Inc. v. Commerce Union Bank, 764 S.W.2d 207, 213 (Tenn.
Ct. App. 1988)) (“Where damages, though the natural results of the act complained of, are not the
necessary result of it, they are termed ‘special damages.’”).
Here, the assessments fit comfortably within Tennessee’s classic consequential, or
“special,” damages formulation. The data breaches, resulting reimbursement to cardholders, and
levying of assessments, though natural results of Spec’s Family’s PCI DSS non-compliance, did
not necessarily follow from it. As Spec’s points out, a non-compliant merchant might never suffer
a data security breach. Moreover, the card brands exercise discretion in issuing assessments,
failing to levy them in every situation and never for PCI DSS non-compliance alone. See R. 121-
4, PageID 2588–89; R. 120-21, PageID 2211–12; Appellant’s Br. at 29–30. Though certainly a
foreseeable consequence of weak data security, the issuance of assessments nevertheless
-5-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
constitutes consequential damages because it did not necessarily follow from Spec’s Family’s non-
compliance. Thus, First Data retains liability for the assessments under § 15(d) of the Merchant
Agreement.
First Data contests this conclusion with several arguments. For example, it maintains that
an “unbroken line” connects Spec’s Family’s data-security non-compliance and liability for the
assessments. But this argument critically fails to establish that the assessments necessarily
followed from PCI DSS non-compliance. Indeed, First Data’s arguments about why the card
brands issue assessments only bolster the conclusion that the brands exercise considerable
discretion in imposing assessments following a breach. For instance, Mastercard reduces and
waives assessments in some cases. And both Mastercard and Visa consider a slew of factors before
issuing assessments.
First Data also argues that because Spec’s paid a separate $10,000 Visa fine for PCI DSS
non-compliance, it concedes that intermediate contractual relationships cannot constitute “steps
removed” from direct damages. But Visa issued that fine solely for non-compliance and regardless
of the criminal attack, thus distinguishing it from the assessments. And even if we assume the
suspect premise that intermediate contractual relationships do not contribute to the consequential
nature of these damages, First Data still faces the problem that both the data breach and the
imposition of assessments do not necessarily follow from Spec’s Family’s actions.
Finally, First Data contends that we should consider the parties’ conduct when interpreting
the Merchant Agreement, citing the “rule of practical construction.” See Hamblen Cty. v. City of
Morristown, 656 S.W.2d 331, 335 (Tenn. 1983). But Tennessee cases since Hamblen County have
reiterated the long-held principle that courts consider conduct only if ambiguity remains after
reviewing the contract’s plain language. See, e.g., Allstate Ins. Co., 195 S.W.3d at 611–12;
-6-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
Planters Gin, 78 S.W.3d at 890. Moreover, Hamblen County itself qualified its use of extrinsic
evidence, cautioning against using conduct “for the purpose of modifying or enlarging or curtailing
[the contract’s] terms.” 656 S.W.2d at 334 (quoting the Restatement of Contracts § 235(d) and
comment); see also Individual Healthcare Specialists, Inc. v. BlueCross BlueShield of Tenn., Inc.,
566 S.W.3d 671, 693 (Tenn. 2019). Satisfied that the Merchant Agreement adequately represents
the parties’ intent, we find it unnecessary to look beyond the plain language of the contract. See
Individual Healthcare Specialists, 566 S.W.3d at 676 (“[W]ritten words are the lodestar of contract
interpretation, and Tennessee courts have rejected firmly any notion that courts may disregard the
written text and make a new contract for parties under the guise of interpretation.”). First Data
retains liability for the assessments under § 15(d) of the Merchant Agreement.
Liability under Section 5 of the Merchant Agreement. First Data further argues that § 5 of
the Merchant Agreement assigns liability to Spec’s as “third-party fees and charges.” The district
court rejected this argument, holding that “third-party fees and charges” in the contract refer to
routine charges associated with card processing services rather than liability for a data breach. We
agree.
Section 5 states, in relevant part, that Spec’s shall pay:
any and all third-party fees and charges associated with the use of [First Data’s]
services, as modified from time to time, including without limitation all
telecommunications costs (except for toll charges relating to dial-up transactions)
and all Network fees and charges. [First Data] will debit Merchant’s designated
settlement account daily in the amount of the interchange fees owed a Credit Card
Issuer or other Networks.
R. 1-3, PageID 18. The Merchant Agreement fails to define the term “third-party fees and
charges,” so the district court turned to the dictionary for the “usual, natural, and ordinary”
meaning of the terms. Adkins, 360 S.W.3d at 411. Thus, “third-party fees and charges” refer to
-7-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
“an amount of money demanded by a third party in association with the use of [First Data’s]
processing services,” not unique liability costs like the assessments. R. 64, PageID 750.
First Data’s attempts to broaden the scope of “third-party fees and charges” to include the
assessments fail in the wider context of the Merchant Agreement. For example, “third-party fees
and charges” directly precedes “associated with the use of [First Data’s] services” in § 5. R. 1-3,
PageID 18. As the district court observed, the assessments are not associated with First Data’s
processing services, but rather relate to reimbursement for liabilities passed down the payment
card chain. Section 5 also describes “third-party fees and charges . . . as modified from time to
time.” R. 1-3, PageID 18. Unlike the examples of modifiable fees listed in § 5—
telecommunications costs and Network fees—the assessments constitute unique, one-off liabilities
that the parties do not “modif[y] from time to time.” Finally, the assessments do not fall within
any of the enumerated fees set out in the Merchant Data Sheet, which § 5 incorporates. See id.,
PageID 22. The Data Sheet lists routine transaction costs like a “Monthly Maintenance/Support”
fee and fees for “Adjustments/Chargebacks.” Id. Although the Data Sheet does reference “issue[r]
reimbursements fees”—a phrase that, on its face, could conceivably include the assessments—the
Mastercard operating regulations reveal that the phrase refers to “excessive chargebacks,” or fees
imposed by the card brands when they reverse a transaction and recoup funds from a merchant,
not assessments arising from a data breach. See R. 120-5, PageID 1668–70; see also Schnuck
Markets, Inc. v. First Data Mech. Servs. Corp., 852 F.3d 732, 738 n.4 (8th Cir. 2017).
Indeed, the reasoning of the only other federal appeals court to address this precise issue
cements our conclusion. Interpreting a similar section in a First Data contract, the Eighth Circuit
in Schnuck Markets construed third-party “fees and charges” as “payments for services,” which
excluded assessments following a data breach “because [the assessments] are imposed to
-8-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
compensate issuing banks for losses they sustained as a result of [the breach].” Id. at 738. It also
examined fees like those on the Merchant Data Sheet and noted that the list—including an “issuer
reimbursement fees” entry—excluded the assessments. Id.
Section 5 of the Merchant Agreement fails to assign Spec’s liability for the assessments.
B. First Material Breach
Because the contract bars First Data from recouping the assessments from Spec’s, the
district court held that First Data materially breached § 5 of the Merchant Agreement by
withholding routine settlement funds in the reserve account. To reach that conclusion, it first held
that Spec’s Family’s PCI DSS non-compliance constituted an immaterial breach, which it found
the company cured by taking steps to become compliant. First Data argues that Spec’s first
materially breached the contract. We disagree. The district court correctly held that First Data
committed the first material breach of the Merchant Agreement by withholding payments due to
Spec’s.
“A breach is ‘material’ if a party fails to perform a substantial part of the contract or one
or more of its essential terms or conditions, the breach substantially defeats the contract’s purpose,
or the breach is such that upon a reasonable interpretation of the contract, the parties considered
the breach as vital to the existence of the contract.” 23 Williston on Contracts § 63:3 (4th ed.)
(“Williston”); see, e.g., Dick Broad. Co. of Tenn. v. Oak Ridge FM, Inc., 395 S.W.3d 653, 661–62
(Tenn. 2013) (turning to Williston Chapter 63 for guidance). When determining the materiality of
a breach, Tennessee courts consider the following factors:
(a) the extent to which the injured party will be deprived of the benefit which he
reasonably expected;
(b) the extent to which the injured party can be adequately compensated for the part
of that benefit of which he will be deprived;
(c) the extent to which the party failing to perform or to offer to perform will suffer
forfeiture;
-9-
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
(d) the likelihood that the party failing to perform or to offer to perform will cure
his failure, taking account of all the circumstances including any reasonable
assurances;
(e) the extent to which the behavior of the party failing to perform or to offer to
perform comports with standards of good faith and fair dealing.
United Brake Sys., Inc. v. Am. Envtl. Prot., Inc., 963 S.W.2d 749, 756 (Tenn. Ct. App. 1997)
(quoting the Restatement (Second) of Contracts § 241 (1979)).
Applying these principles, Spec’s did not materially breach the Merchant Agreement.
While First Data reasonably expected Spec’s Family’s PCI DSS compliance under Schedule B of
the contract, see R. 1-3, PageID 26, Spec’s Family’s non-compliance falls short of “substantially
defeat[ing] the contract’s purpose,” see Williston § 63:3. Indeed, that the parties continued to
perform after the attacks highlighted Spec’s Family’s compliance problems shows that First Data
did not consider the problems “vital to the existence of the contract.” See id. PCI DSS compliance
served as a promise peripheral to the central benefit First Data expected—payment for its
processing services. Moreover, following the attacks, Spec’s investigated the breaches and took
several steps to achieve full PCI DSS compliance, including segmenting off its payment card
server and upping the account data encryption level. See Restatement (Second) of Contracts
§ 241(d) (1979). Spec’s Family’s data-security non-compliance constituted an immaterial breach
of the Merchant Agreement.
First Data’s withholding of settlement funds in the reserve account, on the other hand,
materially breached § 5 of the Merchant Agreement. That section constitutes an essential term of
performance, stating that a Spec’s account “shall be credited and debited in connection with the
services referenced in this Agreement.” R. 1-3, PageID 17; see Williston § 63:3. Thus, when First
Data unilaterally diverted funds from the settlement account to reimburse itself for the
assessments, it deprived Spec’s of its principal expected benefit under the contract—First Data’s
- 10 -
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
faithful execution of processing services. See Restatement (Second) of Contracts § 241(a) (1979).
First Data’s actions materially breached the contract.
C. Interest Amounts
Spec’s cross-appeals the prejudgment and postjudgment interest rates that the district court
applied to the principal amount of the withheld funds. Agreeing with the district court’s analysis,
we affirm both interest rates.
Prejudgment interest. Section 5 of the Merchant Agreement states that “[a]ny payments
which are delinquent shall bear interest at the rate of eighteen percent (18%) per annum or the
highest rate allowed by law, whichever is lower.” R. 1-3, PageID 17. The district court held that
First Data owed Spec’s the “the highest rate allowed” by Tennessee law, the lower of the two
options provided in the contract. Interpreting § 5 according to its ordinary meaning, see Planters
Gin, 78 S.W.3d at 889–90, the district court held that the Merchant Agreement’s reference to
“interest” resulting from “delinquent” payments fit within the Tennessee commercial code’s
definition for that term—“compensation for the use or detention of . . . money over a period of
time.” Tenn. Code Ann. § 47-14-102(8). It therefore set the prejudgment interest rate at the
“applicable formula rate” effective when First Data withheld the payments, or 7.25%. See id. § 47-
14-103(2).
Spec’s argues that the Merchant Agreement entitles it to the 18% rate because § 5 provides
for a “penalty.” It argues that the parties intended that the language in § 5 ensure prompt payment
and compensate for damages, rendering Tenn. Code Ann. § 47-14-103(2) inapplicable here. But
the unambiguous language of § 5 tells a different story. See Adkins, 360 S.W.3d at 412. Section
5 uses the word “interest” and omits any reference to a penalty. And, as the district court noted,
Tennessee’s statutory definition of “interest” encompasses “compensation for the use or detention
- 11 -
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
of . . . money over a period of time.” Tenn. Code Ann. § 47-14-102(8) (emphasis added). It comes
as no surprise, then, that Spec’s itself referred to this amount as “prejudgment interest” in its initial
brief on the topic. The contract fails to clearly provide for a penalty and thus the district court
correctly set the prejudgment interest rate at 7.25%.
Postjudgment interest. In its original judgment order, the district court set the
postjudgment interest rate at 6.25%, noting Spec’s Family’s unopposed argument for that amount.
See Tenn. Code Ann. §§ 47-14-121 to -122. Following First Data’s motion to alter or amend the
judgment, however, it reduced the postjudgment rate to 1.79%, as provided for in 28 U.S.C.
§ 1961. Spec’s argues that the district court improperly reduced the rate. We disagree.
The decision to grant or deny a Rule 59(e) motion “is within the informed discretion of the
district court.” Huff, 675 F.2d at 122; see also Perez v. Aetna Life Ins. Co., 150 F.3d 550, 554 (6th
Cir. 1998) (reviewing a denial of a Rule 59(e) motion). “Under Rule 59, a court may alter the
judgment based on” several factors, including “a clear error of law.” Leisure Caviar, LLC v. U.S.
Fish & Wildlife Serv., 616 F.3d 612, 615 (6th Cir. 2010) (quotation omitted). “Interest shall be
allowed on any money judgment in a civil case recovered in a district court” and “shall be
calculated from the date of the entry of the judgment, at a rate equal to the weekly average 1-year
constant maturity Treasury yield.” 28 U.S.C. § 1961(a). In diversity cases like this one, “federal
law controls postjudgment interest.” Estate of Riddle ex rel. Riddle v. S. Farm Bureau Life Ins.
Co., 421 F.3d 400, 409 (6th Cir. 2005) (quoting F.D.I.C. v. First Heights Bank, FSB, 229 F.3d
528, 542 (6th Cir. 2000)).
The district court granted First Data’s Rule 59(e) motion because it acknowledged that its
original postjudgment interest award constituted “a clear error of law.” It found our mandate that
federal law decide postjudgment interest awards in diversity actions controlling and deemed First
- 12 -
Case Nos. 17-5884/5950, Spec’s Family Partners v. First Data Merchant Servs.
Data’s failure to object to its original award “understandable in light of 28 U.S.C. § 1961’s
mandatory language.” The district court acted within its discretion in so holding. See Huff,
675 F.2d at 122. We therefore affirm the 1.79% postjudgment rate.
III.
We AFFIRM in full.
- 13 -