Paymentech v. Landry's, No. 21-20447 (5th Cir. 2023)
Annotate this Case
Justia Opinion Summary
Want to stay in the know about new opinions from the Fifth Circuit US Court of Appeals?
Sign up for free summaries delivered directly to your inbox. Learn More ›
You already receive new opinion summaries from Fifth Circuit US Court of Appeals. Did you know we offer summary newsletters for even more practice areas and jurisdictions? Explore them here.
A major data breach compromised sensitive consumer information on thousands of credit cards. In this appeal, we address who must pay for the cleanup. Beginning in 2014, hackers compromised credit card data at multiple businesses owned by Landry’s Inc. (“Landry’s”). Many of those cards belonged to Visa and Mastercard. In response, Visa and Mastercard imposed over twenty million dollars in assessments on JPMorgan Chase and its subsidiary Paymentech (collectively, “Chase”), who were responsible for securely processing card purchases at Landry’s properties. Chase then sued Landry’s for indemnification, and Landry’s impleaded Visa and Mastercard. The district court dismissed Landry’s third-party complaints against Visa and Mastercard and granted summary judgment for Chase, finding that Landry’s had a contractual obligation to indemnify Chase. Landry’s argued that it should not have to indemnify Chase because the assessments are not an enforceable form of liquidated damages.
The Fifth Circuit affirmed. The court explained that since Landry’s indemnification obligation stems from its own acts or omissions under the Merchant Agreement, the debt is its own. Further, the court wrote that Landry’s alleged for its deceptive business practices claims that the assessments were “invalid” under the Payment Brand Rules and “applicable law” and, therefore, the Payment Brands’ “imposition and collection of the [assessments] was an unlawful business practice.” Because these claims turn on the assessments’ enforceability under Chase’s contracts with the Payment Brands, they are functionally the same as the subrogated claims. Since Landry’s cannot challenge the Payment Brands over those contracts as Chase’s subrogee, it cannot do so through a change in labeling.
Download PDF
Case: 21-20447 Document: 00516653713 Page: 1 Date Filed: 02/23/2023 United States Court of Appeals for the Fifth Circuit United States Court of Appeals Fifth Circuit FILED February 23, 2023 No. 21-20447 Lyle W. Cayce Clerk Paymentech, L.L.C.; JPMorgan Chase Bank, N.A., Plaintiffs—Appellees/Cross-Appellants, versus Landry’s Incorporated, Defendant—Appellant/Cross-Appellee, versus Visa, Incorporated; Mastercard International, Incorporated, Third Party Defendants—Appellees. Appeal from the United States District Court for the Southern District of Texas USDC No. 4:18-CV-1622 Before Higginbotham, Duncan, and Engelhardt, Circuit Judges. Stuart Kyle Duncan, Circuit Judge: A major data breach compromised sensitive consumer information on thousands of credit cards. In this appeal, we address who must pay for the cleanup. Beginning in 2014, hackers compromised credit card data at Case: 21-20447 Document: 00516653713 Page: 2 Date Filed: 02/23/2023 No. 21-20447 multiple businesses owned by Landry’s Inc. (“Landry’s”). Many of those cards belonged to Visa and Mastercard. In response, Visa and Mastercard imposed over twenty million dollars in assessments on JPMorgan Chase and its subsidiary Paymentech (collectively, “Chase”), who were responsible for securely processing card purchases at Landry’s properties. Chase then sued Landry’s for indemnification, and Landry’s impleaded Visa and Mastercard. The district court dismissed Landry’s third-party complaints against Visa and Mastercard and granted summary judgment for Chase, finding that Landry’s had a contractual obligation to indemnify Chase. Landry’s now argues that it should not have to indemnify Chase because the assessments are not an enforceable form of liquidated damages. Even if they are, Landry’s contends that summary judgment was improper because fact disputes remain about its contractual duty to indemnify. Finally, Landry’s argues that it should be able to recoup any liability to Chase from Visa and Mastercard, who wrongly imposed the assessments in the first place. We disagree on all counts. We therefore affirm and remand solely for the district court to determine whether Chase should receive prejudgment interest. I. A. First, some background on the credit and debit card system. Sitting atop the system are companies like Visa and Mastercard (“Payment Brands”), which operate networks that facilitate card transactions. The intermediaries in the system are banks, which act in two capacities. As “issuers,” banks issue cards to consumers. As “acquirers,” banks give merchants access to the Payment Brands’ networks by processing card payments. See Pulse Network, L.L.C. v. Visa, Inc., 30 F.4th 480, 484–86 (5th Cir. 2022) (describing same structure in context of a debit network market). 2 Case: 21-20447 Document: 00516653713 Page: 3 Date Filed: 02/23/2023 No. 21-20447 The system involves various contractual relationships. The Payment Brands contract with both issuers and acquirers. Acquirers, in turn, contract with merchants. Importantly, the Payment Brands have no direct contractual relationship with merchants; they contract only with a merchant’s acquirer. Nor do acquirers and issuers contract with one another; they are connected only indirectly via their respective contracts with the Payment Brands. This diagram from one of the parties’ briefs helpfully sketches these relationships: Visa and Mastercard each have rules governing this interlocking system—the “Visa Core Rules” and the Mastercard “Standards.” (We refer to them together as the “Rules”). The Rules are incorporated into the Payment Brands’ contracts with acquirers and issuers and into the acquirers’ contracts with merchants. The upshot is that the Rules bind every party to the payment processing system—merchants, acquirers, issuers, and the Payment Brands themselves. Three features of the Rules are important here. First, the Rules require acquirers and merchants to follow industry-wide security protocols to protect card data. Most prominent are the Payment Card Industry Data Security Standards (“PCI DSS”), which require measures to protect 3 Case: 21-20447 Document: 00516653713 Page: 4 Date Filed: 02/23/2023 No. 21-20447 cardholder data and apply to “any network component, server or application that is included in, or connected to, the cardholder data environment.” 1 Second, the Rules require responsive measures when an entity discovers a potential data breach. For example, they provide for an industryapproved forensic investigator to investigate any suspected breach. 2 Investigators must make findings about whether the potentially compromised entity complied with the security protocols. Third, and most relevant here, the Rules impose loss-shifting schemes that effectively make acquirers compensate issuers impacted by data breaches. Such breaches impose significant costs on issuers—they must reimburse cardholders for fraudulent charges, notify affected customers, replace compromised cards, and monitor at-risk accounts. The Rules allow the Payment Brands to impose “assessments” on parties who cause such harms by failing to comply with security protocols. The Payment Brands then distribute the assessments to impacted issuers. Visa and Mastercard’s loss-shifting programs—respectively, the Global Compromised Account Recovery (“GCAR”) program and the Account Data Compromise (“ADC”) program—operate similarly. Both give the Payment Brand the sole right to determine whether a breach qualifies for assessments, and, if it does, whether to impose them. Notably, both programs hold acquirers responsible for their merchant’s conduct. But the programs do not determine whether a merchant must indemnify an acquirer for assessments—that risk allocation depends on the merchant-acquirer 1 The PCI DSS are promulgated by the PCI Security Standards Council, a body created by multiple electronic payment processing companies to help bring uniformity to the industry’s data security practices. 2 Mastercard mandates hiring a forensic investigator, while Visa has discretion to mandate hiring one. 4 Case: 21-20447 Document: 00516653713 Page: 5 Date Filed: 02/23/2023 No. 21-20447 contract. Finally, both programs allow an internal appeal to the Payment Brand regarding any assessments. While these loss-shifting rules are designed to compensate issuers, they also include some benefits for acquirers. GCAR caps acquirers’ total liability exposure and allows Visa to impose alternatives if assessments would prove catastrophic. ADC allows Mastercard to reduce or eliminate assessments based on various mitigating factors. In sum, the GCAR and ADC programs make each Payment Brand an arbiter of sorts, balancing the competing interests of acquirers and issuers in the aftermath of a data breach. With this background in mind, we turn to the facts. B. Landry’s is a multi-billion-dollar company that operates restaurants, hotels, and casinos throughout the United States. Landry’s contracted with JPMorgan Chase, through its subsidiary Paymentech, to be its acquirer and process card purchases made at Landry’s properties. The contract (“Merchant Agreement”) required Landry’s to comply with all applicable Payment Brand rules and data security standards, including its cooperation with any forensic investigation required by a Payment Brand in the event of a breach. Finally, the Merchant Agreement required Landry’s to indemnify Chase for any assessments levied on Chase due to Landry’s lack of compliance with security protocols or the compromise of cardholder data. From May 2014 to December 2015, Landry’s suffered a data breach. Hackers installed malware in some of Landry’s payment processing systems that lifted sensitive customer data from cards. Landry’s reported the breach and hired Mandiant, a Payment Brands-approved forensic investigation firm. Mandiant released its findings in a February 2016 report (“Mandiant Report”), concluding that there was “evidence[] the cardholder data environment was breached” and that approximately 180,000 Visa and 5 Case: 21-20447 Document: 00516653713 Page: 6 Date Filed: 02/23/2023 No. 21-20447 Mastercard-branded cards had been exposed. Mandiant attributed the breach to Landry’s lack of compliance with the PCI DSS. 3 In 2017, Visa and Mastercard each determined pursuant to their separate contracts with Chase that the breach justified imposing assessments on Chase, as Landry’s acquirer. Visa levied approximately $12.5 million in assessments; Mastercard approximately $10.5 million. Chase exercised its right to appeal the assessments and presented arguments provided by Landry’s. While Visa upheld its assessments, Mastercard reduced its levy by approximately $3 million. Chase then sued Landry’s, demanding indemnification against the assessments. Landry’s impleaded the Payment Brands, challenging the assessments’ validity and seeking to recover from them in the event it was held liable to Chase. Landry’s third-party complaints included claims against the Payment Brands as Chase’s equitable subrogee as well as claims in Landry’s own right. The district court dismissed the third-party complaints in their entirety under Federal Rule of Civil Procedure 12(b)(6), reasoning that Landry’s lacked standing to challenge Chase’s contracts with the Payment Brands. Landry’s then moved for summary judgment against Chase, arguing the assessments were legally unenforceable. The district court denied the motion, finding the assessments reasonably compensated the harm caused by the breach. Chase subsequently moved for partial summary judgment on its 3 Specifically, the report found that Landry’s did not require two-factor authentication to remotely access its corporate network, thus allowing the hackers to “move laterally” into the card data environment, and that Landry’s had used a shared local administrator password that had not been regularly updated to access accounts connected to card data. The hackers exploited these weaknesses to “spread malware across a significant portion of [Landry’s] properties” and “harvest cardholder data” as it was being processed during the transaction process. 6 Case: 21-20447 Document: 00516653713 Page: 7 Date Filed: 02/23/2023 No. 21-20447 indemnification claim, and Landry’s countered by moving to strike the Mandiant Report. The district court denied Landry’s motion and granted summary judgment for Chase. It reasoned that the Mandiant Report was admissible because it was akin to an auditor’s report, not expert testimony, and that Chase was contractually entitled to indemnification because it had shown that Landry’s violated the data security guidelines. Landry’s now appeals both the dismissal of its third-party complaints against the Payment Brands and the summary judgment granted to Chase. Chase cross-appeals, asking us to reform the judgment to include prejudgment interest, which the district court did not grant. II. We review both a summary judgment and a Rule 12(b)(6) dismissal de novo. Davidson v. Fairchild Controls Corp., 882 F.3d 180, 184 (5th Cir. 2018); Ruiz v. Brennan, 851 F.3d 464, 468 (5th Cir. 2017). III. Landry’s raises three arguments on appeal. First, it argues summary judgment should have been granted in its favor because the Payment Brands’ assessments on Chase were unenforceable. Second, in the alternative, Landry’s argues summary judgment was improper because there is a fact dispute over whether it breached any security protocols. Finally, even if it is liable to Chase, Landry’s argues it can at least maintain its suits against the Payment Brands to recoup what it had to pay Chase. We address each argument in turn. A. Landry’s first argues the assessments on Chase were not valid liquidated damages under applicable state laws. All agree New York law governs Chase’s contract with Mastercard and California law governs 7 Case: 21-20447 Document: 00516653713 Page: 8 Date Filed: 02/23/2023 No. 21-20447 Chase’s contract with Visa. The premise of Landry’s argument is that liquidated damages must estimate damages only to the nonbreaching party, not to a third party. Landry’s claims the assessments do not estimate the Payment Brands’ damages for two reasons. First, the assessments are meant to compensate third-party issuers for their breach-related damages. Second, the Payment Brands are not obligated to pay the issuers’ damages, so their discretionary distribution of assessments to issuers cannot represent “damages” to the Payment Brands. Because the assessments are unenforceable, the argument continues, Chase had no obligation to pay but did so anyway. So, any duty by Landry’s to indemnify Chase was extinguished by the common law voluntary payment rule. See generally BMG Direct Mktg., Inc. v. Peake, 178 S.W.3d 763, 768 (Tex. 2005) (discussing voluntary payment rule). California and New York law treat liquidated damages similarly. Both presume the validity of liquidated damages in commercial contracts unless the challenging party shows otherwise. See Cal. Civ. Code § 1671(b); JMD Holding Corp. v. Cong. Fin. Corp., 828 N.E.2d 604, 609 (N.Y. 2005). Both also maintain the traditional distinction between liquidated damages, which are enforceable, and penalties, which are not. Under both states’ laws, the key question is whether the amount of contractual damages is proportionate to the harm the parties could have reasonably foreseen would flow from a breach. See, e.g., Ridgley v. Topa Thrift & Loan Ass’n, 953 P.2d 484, 488 (Cal. 1998); Truck Rent-A-Ctr., Inc. v. Puritan Farms 2nd, Inc., 361 N.E.2d 1015, 1018 (N.Y. 1977). 1. Landry’s tries to marshal California and New York authorities to support its argument that a liquidated damages provision may legally compensate only the nonbreaching party to the contract. But none of the 8 Case: 21-20447 Document: 00516653713 Page: 9 Date Filed: 02/23/2023 No. 21-20447 cases Landry’s cites teaches that lesson. Landry’s thus fails to overcome the assessments’ presumptive validity under state law. Landry’s first relies on the California Supreme Court’s 1998 decision in Ridgley v. Topa Thrift & Loan Association. Landry’s zeroes in on the court’s statement that assessments are unenforceable penalties when they “bear[] no reasonable relationship to the range of actual damages that the parties could have anticipated would flow from a breach.” Ridgley, 953 P.2d at 488 (Landry’s emphasis). But Landry’s overreads that statement. One could just as easily read the quoted language to allow the contracting parties to anticipate damages to third parties. 4 More to the point, Ridgley did not involve a third party at all and so the court had no occasion to opine on the distinct question of third-party damages before us. Landry’s other California authorities fare no better. For instance, Bondanza v. Peninsula Hospital and Medical Center involved a different standard for enforceability than the one here. 590 P.2d 22, 25–26 (Cal. 1979). The liquidated damages provision there was in a consumer rather than a commercial contract, thus requiring the enforcing defendant to prove “it would be impracticable or extremely difficult to fix the actual damage.” Id. at 25 (quoting Cal. Civ. Code § 1671). The court refused to enforce the provision because the parties had agreed only that liquidated damages would be “reasonable,” and the defendant did not try to show it would be hard to fix actual damages. Id. at 25–26. The fact that the liquidated damages, if enforced, would have ultimately flowed to a third party played no role in the court’s analysis. See ibid. 4 That reading of Ridgley would be consistent with the California Supreme Court’s previous observation that liquidated damages need only reasonably estimate “fair average compensation for any loss that may be sustained.” Garrett v. Coast & S. Fed. Sav. & Loan Ass’n, 511 P.2d 1197, 1202 (Cal. 1973) (emphasis added). 9 Case: 21-20447 Document: 00516653713 Page: 10 Date Filed: 02/23/2023 No. 21-20447 Landry’s also fails to support its argument with any New York authorities. For instance, in Aetna Casualty and Surety Company v. Aniero Concrete Company, Inc., 404 F.3d 566, 567 (2d Cir. 2005) (per curiam), the court (applying New York law) declined to enforce the liquidated damages provision because it held the underlying contract “was invalid due to an unsatisfied express condition precedent.” So, all claims predicated on the nullified contract necessarily failed. See id. at 601–02. The involvement of a third party was immaterial. Finally, Landry’s cites Dyer Brothers Golden West Iron Works v. Central Iron Works for its one-sentence explication of a 1908 New York case that refused to enforce liquidated damages that flowed to a third party. 189 P. 445, 447 (Cal. 1920) (discussing McCord v. Thompson-Starrett Co., 113 N.Y.S. 385 (N.Y. App. Div. 1908)). But in summarizing that case, the Dyer Brothers court highlighted the key feature that separates it from our facts: the provision was unenforceable because “the money was not to be apportioned among the parties to the contract . . . but was the property of the [third-party] association created by the contract, which, as such, could suffer no pecuniary loss from the violation of the agreement.” Id. at 447 (emphasis added). The problem was not the involvement of a third party per se, but rather that the third-party association was incapable of suffering damages. So, the purported liquidated damages were “in fact given to secure penalties for noncompliance with the [contract].” McCord, 113 N.Y.S. at 386. Here, by contrast, Landry’s does not deny that the issuers suffered damages responding to the data breach. In sum, Landry’s does not provide, nor have we found, any relevant state authority barring parties in commercial contracts from tying liquidated damages to the anticipated harm to a third party. Landry’s has therefore not rebutted the assessments’ presumptive validity. See Cal. Civ. Code § 1671(b); JMD Holding Corp., 828 N.E.2d at 609. 10 Case: 21-20447 Document: 00516653713 Page: 11 Date Filed: 02/23/2023 No. 21-20447 2. But even if Landry’s legal premise were correct, there is still a problem: Landry’s is mistaken that the assessments do not estimate the Payment Brands’ own losses. True, the assessments compensate issuers for their breach-related losses. But the assessments also reflect the Payment Brands’ damages because the Payment Brands are contractually obliged to pay any assessments they collect to issuers. 5 That is an independent reason why Landry’s claims must fail. Landry’s contends the assessments cannot be liabilities because the Payment Brands impose and distribute assessments as a matter of discretion, not contractual obligation. A voluntary payment, Landry’s says, is not a liability. We disagree. Landry’s conflates the Payment Brands’ front-end discretion to impose assessments with their back-end obligation to distribute the assessments they collect. It is true, as Landry’s emphasizes, that the Payment Brands have considerable discretion at the start of the assessment process. The Visa Core Rules reserve Visa’s authority to decide whether to impose assessments and in what amount based on the GCAR criteria. 6 Mastercard retains similar authority under its rules. 7 This discretion cannot be second-guessed by the issuers or the liable acquirers. 5 The Payment Brands ultimately retain no portion of the assessments except a management fee to cover the cost of operating the GCAR and ADC programs. 6 As the Visa Core Rules put it, “Visa has authority and discretion to determine . . . estimated Counterfeit Fraud Recovery and Operating Expense Recovery amounts . . . in accordance with the Visa Global Compromised Account Recovery (GCAR) Guide and the available information regarding each event.” 7 “MasterCard reserves the right to determine which ADC Events will be eligible for ADC operation reimbursement and/or ADC fraud recovery. . . . MasterCard may 11 Case: 21-20447 Document: 00516653713 Page: 12 Date Filed: 02/23/2023 No. 21-20447 But once the Payment Brands decide to levy assessments, their discretion ends: any assessments they collect belong to the issuers. Under the ADC program, for instance, Mastercard “has no obligation to disburse an amount in excess of the amount that MasterCard actually and finally collects from the responsible Customer.” By clear implication, Mastercard must disburse what it does collect. Similarly, Visa provides that “issuer recoveries are limited to the amount, if any, that Visa collects from the Compromised Entity’s acquirer(s).” Moreover, the GCAR and ADC programs include rules governing the timing and manner of the assessments’ distribution. Visa’s, for example, provide that “[i]ssuers are credited approximately 30 calendar days after Visa has collected the liability funds from the acquirer(s).” These later stages of the assessment process do not include the same discretionary language that marks the beginning. In short, contrary to Landry’s assertions, the Payment Brands do not have free rein over the assessments. Once assessments have been collected, they are contractually obligated to distribute them to issuers. 8 During the litigation, the Payment Brands confirmed this is the right way to read the contracts. Visa’s brief concedes it “must reimburse issuers for any losses recovered through the GCAR program.” Visa Br. at 37. Mastercard’s counsel did the same at oral argument, explaining “the determine the responsible Customer’s financial responsibility with respect to an ADC Event.” 8 We are not the first court to reach this conclusion. Recently, a Texas court of appeals, applying California law, upheld Visa’s GCAR program against a similar challenge. Visa Inc. v. Sally Beauty Holdings, Inc., 651 S.W.3d 278 (Tex. App.—Fort Worth 2021, pet. filed). The court recognized that Visa was contractually obligated to reimburse issuers for their damages “condition[ed] . . . on Visa’s successful imposition and collection of the GCAR assessment.” Id. at 286–87 & n.14; see also id. at 296 n.39 (noting that “[a]lthough Visa’s liability is contingent on Visa’s ability to collect the calculated assessment from the responsible acquirers, it nonetheless exists” (cleaned up)). 12 Case: 21-20447 Document: 00516653713 Page: 13 Date Filed: 02/23/2023 No. 21-20447 distribution of the assessments is provided for in the rules, and that’s part of the agreement between Mastercard and its banks.” 9 Visa’s counsel also explained that Visa’s discretion regarding assessments is “built in on the front end before the assessment is levied.” 10 These representations confirm what the contracts say. Because the Payment Brands are liable to issuers for any collected assessments, Landry’s argument fails on its own terms: the assessments reflect the Payment Brands’ own liabilities, not only harm to issuers. So, even assuming state law requires liquidated damages to estimate harm to the nonbreaching party alone, the Payment Brands’ own liability to the issuers would satisfy that standard. Either way, the assessments are enforceable. B. Alternatively, Landry’s argues summary judgment for Chase was improper because genuine disputes remain over whether Landry’s had a duty to indemnify. The district court granted summary judgment for Chase after finding that the Mandiant Report showed Landry’s violated security protocols, triggering Landry’s obligation to indemnify Chase against the resulting assessments. We agree with the district court, albeit on different grounds. The Merchant Agreement, which is governed by Texas law, contains the following indemnification provision: 9 Oral Argument at 33:00, Paymentech v. Landry’s (No. 21-20447), https://www.ca5.uscourts.gov/OralArgRecordings/21/21-20447_12-5-2022.mp3. 10 Id. at 38:35. 13 Case: 21-20447 Document: 00516653713 Page: 14 Date Filed: 02/23/2023 No. 21-20447 You [Landry’s] understand that your failure to comply with the Payment Brand Rules,[ 11] including the Security Guidelines,[ 12] or the compromise of any Payment Instrument Information, may result in assessments, fines, and/or penalties by the Payment Brands, and you agree to indemnify and reimburse us [Chase] immediately for any such assessment, fine, or penalty imposed on [Chase]. Landry’s argues this clause requires Chase to prove that Landry’s violated the Security Guidelines or that card data was compromised—it is not enough that the Payment Brands imposed assessments. Landry’s further argues that Chase cannot show either condition occurred because the Mandiant Report was not competent summary judgment evidence. Chase counters that Landry’s duty arose when the Payment Brands imposed assessments after making their own determination that Landry’s violated the Security Guidelines. At bottom, the parties disagree over who decides whether Landry’s violated the Security Guidelines: the Payment Brands or a court. We favor Chase’s interpretation for several reasons. First, it comes within the natural reading of the text. The Merchant Agreement requires Landry’s to indemnify Chase for “any such assessment[s],” referring to assessments “by the Payment Brands” that “result” from “failure to comply with the Payment Brand Rules . . . or the compromise of any Payment Instrument Information.” Here, the Payment Brands levied assessments because they found the breach was caused by Landry’s noncompliance with the PCI DSS. For instance, Visa’s letter to Chase announcing the assessments documented its investigation into intrusions at 14 different 11 The Merchant Agreement defines ‘Payment Brand Rules’ as “the bylaws, rules, and regulations, as they exist from time to time, of the Payment Brands.” 12 As relevant here, the Merchant Agreement defines ‘Security Guidelines’ to include the PCI DSS. 14 Case: 21-20447 Document: 00516653713 Page: 15 Date Filed: 02/23/2023 No. 21-20447 Landry’s properties. For each, Visa found “conclusive evidence” of a breach, which it attributed to Landry’s noncompliance with the PCI DSS. Landry’s may dispute Chase’s ability to independently prove the Payment Brands’ conclusions on this record, but it is within the text of the clause that the assessments were imposed “by the Payment Brands” as a “result” of Landry’s “failure to comply with the Payment Brand Rules.” Furthermore, the Merchant Agreement incorporates the Payment Brand Rules, which give the Payment Brands the right to determine whether someone violated them. The agreement provides that “[t]he Payment Brand Rules . . . are made a part of this Agreement for all purposes,” and it requires Landry’s to “comply with . . . all Payment Brand Rules as may be applicable to you[.]” The rules make the Payment Brands the arbiters of their assessment programs. Mastercard “has the sole authority to interpret and enforce the Standards,” and its “determinations with respect to the occurrence of and responsibility for [data breaches] are conclusive.” Visa’s Core Rules likewise reserve the “authority and discretion to determine . . . estimated [assessment] amounts, Issuer eligibility, and Acquirer liability under the GCAR program.” 13 Landry’s understood how the GCAR and ADC programs worked when it entered the contract. So, it cannot complain now that those programs give the Payment Brands the authority to determine who violated the security protocols. This conclusion is reinforced by two final textual clues. Landry’s duty to indemnify arises “immediately” for covered assessments. And, elsewhere in the Merchant Agreement, Landry’s agrees that “adjustments, fees, charges, fines, assessments, penalties, and all other liabilities are due and 13 Because an acquirer cannot be liable under GCAR program without it or its merchant violating required security protocols such as the PCI DSS, the Visa Core Rules necessarily reserve the authority to make determinations about compliance. 15 Case: 21-20447 Document: 00516653713 Page: 16 Date Filed: 02/23/2023 No. 21-20447 payable by [Landry’s] when [Chase] receive[s] notice thereof from the Payment Brands or otherwise pursuant to Section 4 herein.” 14 Tying an immediate obligation to the Payment Brands’ mere provision of notice further supports the conclusion that the parties intended the Payment Brands to be the arbiters with respect to assessments. The Payment Brands, after all, oversee an elaborate system to investigate data breaches and adjudicate the propriety of assessments. Accordingly, summary judgment for Chase was proper. This is so regardless of the competency or the findings of the Mandiant Report. The Payment Brands imposed assessments on Chase after determining that Landry’s caused the breach through noncompliance with the PCI DSS, and that is sufficient under the Merchant Agreement. Landry’s and Chase are sophisticated parties familiar with the loss-shifting inherent in the GCAR and ADC programs, so we will not disturb the allocation of risk adopted by the parties themselves. IV. Because Landry’s is liable to Chase, the question becomes whether Landry’s can pursue its third-party complaints to recoup its liability from the Payment Brands. Landry’s brought six claims against each Payment Brand, four as Chase’s equitable subrogee—that is, standing in Chase’s shoes and asserting Chase’s rights—and two as “direct” claims “in its own right.” 15 The district court properly dismissed these claims, both subrogated and direct, because Landry’s lacks standing. 14 Landry’s. Section 4 provides Chase with various options for collecting funds owed by 15 The claims differed materially between each Payment Brand only with respect to which state’s laws they were brought under. 16 Case: 21-20447 Document: 00516653713 Page: 17 Date Filed: 02/23/2023 No. 21-20447 A. We begin with the subrogated claims. As a threshold matter, the parties dispute whether Texas or New York law governs Landry’s subrogation rights. We need not decide this question because Landry’s claims fail under both. Equitable subrogation is the doctrine by which a party, after having paid the losses of another party, obtains that party’s rights and remedies against the third party that caused the loss. See Gen. Star Indem. Co. v. Vesta Fire Ins. Corp., 173 F.3d 946, 949 (5th Cir. 1999) (applying Texas law); Winkelmann v. Excelsior Ins. Co., 650 N.E.2d 841, 843 (N.Y. 1995). The doctrine’s paradigmatic application is in the insurance context. See Frymire Eng’g Co. ex rel. Liberty Mut. Ins. Co. v. Jomar Int’l, Ltd., 259 S.W.3d 140, 142 (Tex. 2008). For instance, “in the typical example of subrogation, an insurer attempts to recoup covered medical expenses from the tortfeasor who caused the insured’s injuries and need for treatment in the first place.” Aetna Health Plans v. Hanover Ins. Co., 56 N.E.3d 213, 218 (N.Y. 2016) (Stein, J., concurring). Subrogation thus allows the subrogee to “stand[] in the shoes” of an injured party and recover from the wrongdoer who is culpable for the loss. Cont’l Cas. Co. v. N. Am. Capacity Ins. Co., 683 F.3d 79, 85 (5th Cir. 2012) (citation omitted); see also Millennium Holdings LLC v. Glidden Co., 53 N.E.3d 723, 728 (N.Y. 2016); Fasso v. Doerr, 903 N.E.2d 1167, 1170 (N.Y. 2009). Landry’s compares itself to an insurer, arguing that if it must indemnify Chase, then it should be able “to recover the losses that Chase sustained by reason of the wrongful conduct of the Payment Brands.” The 17 Case: 21-20447 Document: 00516653713 Page: 18 Date Filed: 02/23/2023 No. 21-20447 wrongful conduct Landry’s alleges for all its subrogated claims is the Payment Brands’ levying of “illegal assessments” on Chase. 16 Landry’s analogy falls short for one overarching reason: Landry’s paid its own debt, not the Payment Brands’ debt. As discussed, equitable subrogation exists to prevent an innocent party from having to bear a loss attributable to a wrongdoing third party. See Md. Cas. Co. v. W.R. Grace & Co., 218 F.3d 204, 211 (2d Cir. 2000). It follows from that principle that subrogation is a “remedy not given to one who merely pays his own debt.” Pathe Exch. v. Bray Pictures Corp., 247 N.Y.S. 476, 481 (N.Y. App. Div. 1931); Smart v. Tower Land & Inv. Co., 597 S.W.2d 333, 337 (Tex. 1980) (equitable subrogation is for “one who pays a debt owed by another”); Mid-Continent Ins. Co., 236 S.W.3d at 776. As explained below, Landry’s debt is its own, not that of the Payment Brands, because the assessments stem from Landry’s own conduct—namely, its failure to abide by the PCI DSS as it promised to do in the Merchant Agreement. To support this conclusion, the Payment Brands correctly point to Jetro Holdings, LLC v. MasterCard International, 88 N.Y.S.3d 193 (N.Y. App. Div. 2018), which held that a merchant obligated to indemnify its acquirer could not challenge Mastercard’s assessments as the acquirer’s subrogee. Id. 16 Landry’s first cause of action was for breach of contract, alleging the assessments were “not authorized” by the GCAR/ADC programs and “unenforceable under applicable law.” The second was for breach of the covenant of good faith and fair dealing, likewise alleging that Visa’s assessments were “not authorized by the Visa Rules and GCAR Guide or applicable law” and that Mastercard’s assessments “w[ere] not authorized by the Standards or applicable law.” The third cause of action alleged that the Payment Brands were “unjustly enriched” because they imposed assessments “without any contractual or lawful basis for so doing.” The fourth and final cause of action was for deceptive business practices. It alleged the Payment Brands deceived Chase by imposing assessments that were “invalid under . . . applicable law.” All of Landry’s subrogated claims thus turn on the enforceability of the assessments. 18 Case: 21-20447 Document: 00516653713 Page: 19 Date Filed: 02/23/2023 No. 21-20447 at 196. The court found that the merchant’s (Jetro) contract with PNC, its acquirer, constituted a “separate and distinct obligation to PNC” that precluded subrogation. Ibid. In other words, the contract made Jetro’s indemnification of PNC its own debt. The court noted two pertinent aspects of that contract. First, it noted that Jetro had agreed to indemnify PNC for assessments that resulted from its own “acts or omissions,” such as failing to comply with data security rules. See id. at 195–96. Second, it observed that Jetro was required to indemnify PNC even if Mastercard illegally imposed assessments. Id. at 196. Thus, Jetro’s obligation to PNC was “broader” than PNC’s obligation to Mastercard. Ibid. As in Jetro, the Merchant Agreement tied Landry’s indemnification obligation to Landry’s own acts or omissions, so the assessments constitute Landry’s own debt. The agreement provided that Landry’s would indemnify Chase for assessments resulting from “failure to comply with the Payment Brand Rules, including the Security Guidelines.” Unlike an insurer who passively becomes responsible for a loss caused by someone else, the agreement made Landry’s responsible only for assessments resulting from its own conduct. The resulting “debt” is therefore attributable to Landry’s, not the Payment Brands. See ibid. 17 Landry’s tries to distinguish Jetro because the second contractual feature there is not present here. Landry’s denies that it must indemnify Chase even for illegal assessments, and thus it argues that its obligation to Chase is not broader than Chase’s obligation to the Payment Brands, as was the case in Jetro. But even accepting this difference, Jetro remains apposite. 17 In other words, this is not a case in which the Payment Brands as wrongdoers “in equity and good conscience should have [] discharged” the debt. See Bank of Am. v. Babu, 340 S.W.3d 917, 925 (Tex. App.—Dallas 2011, pet. denied) (quoting Murray v. Cadle Co., 257 S.W.3d 291, 299 (Tex. App.—Dallas 2008, pet. denied)). 19 Case: 21-20447 Document: 00516653713 Page: 20 Date Filed: 02/23/2023 No. 21-20447 We read Jetro as identifying two independently sufficient bases for finding Jetro’s obligation separate and distinct. Both features, in other words, were standalone reasons for making the assessments attributable to Jetro. Nothing in the opinion suggests both features were logically necessary to the outcome. Thus, since Landry’s indemnification obligation stems from its own acts or omissions under the Merchant Agreement, the debt is its own. 18 B. Landry’s direct claims for unjust enrichment and deceptive business practices remain. Their dismissal was also proper because these claims were, as a practical matter, also subrogated claims. They therefore fail for the same reason given above. We evaluate pleadings based on substance, not labels. Gaudet v. United States, 517 F.2d 1034, 1035 (5th Cir. 1975) (per curiam); Armstrong v. Capshaw, Goss & Bowers, LLP, 404 F.3d 933, 936 (5th Cir. 2005). While Landry’s styled these claims as “direct” and made “in [Landry’s] own right,” they require litigating Chase’s contractual relationships with the Payment Brands just as the subrogated claims do. Landry’s alleged the Payment Brands were “unjustly enriched” by “imposing [assessments] on [Chase] . . . without any contractual or lawful basis for doing so.” Likewise, Landry’s alleged for its deceptive business practices claims that the assessments were “invalid” under the Payment Brand Rules and “applicable law” and therefore the Payment Brands’ “imposition and collection of the [assessments] was an unlawful business practice.” Because these claims turn 18 Additionally, we note that equitable subrogation is not a matter of right but arises through equity based on the facts and circumstances of the case. Murray, 257 S.W.3d at 300; Costello on Behalf of Stark v. Geiser, 85 N.Y.2d 103, 109 (N.Y. 1995). Since Landry’s has already had an opportunity to litigate the validity of the assessments in its action against Chase, it is no injustice to say that it cannot try again against new defendants. 20 Case: 21-20447 Document: 00516653713 Page: 21 Date Filed: 02/23/2023 No. 21-20447 on the assessments’ enforceability under Chase’s contracts with the Payment Brands, they are functionally the same as the subrogated claims. Since Landry’s cannot challenge the Payment Brands over those contracts as Chase’s subrogee, it cannot do so through a change in labeling. 19 V. Because we rule for Chase, we must address its cross-appeal for prejudgment interest. The district court did not act on Chase’s request for prejudgment interest and thus implicitly denied it. See Manuel v. Turner Indus. Grp., L.L.C., 905 F.3d 859, 868 (5th Cir. 2018). Chase now asks us to reform the judgment to include prejudgment interest, while Landry’s argues we should remand. We decline to reform the judgment. While prejudgment interest is usually awarded “as a matter of course” under Texas law, the district court may exercise its discretion to reduce or deny it if “exceptional circumstances” exist. Executone Info. Sys., Inc. v. Davis, 26 F.3d 1314, 1330 (5th Cir. 1994) (citation omitted). Because the court must explain those circumstances, “[i]f the district court denies prejudgment interest without explanation, our appropriate course is to remand the issue so that the court may either explain the exceptional circumstances . . . or award interest at the appropriate rate.” Ibid; see also Meaux Surface Prot., Inc. v. Fogleman, 607 F.3d 19 Landry’s argues that the district court did not address these claims and so we must reverse at least as to them. Even if that were so, we may affirm for any reason supported by the record, United States v. Gonzalez, 592 F.3d 675, 681 (5th Cir. 2009), and the record cleanly presents this issue. 21 Case: 21-20447 Document: 00516653713 Page: 22 Date Filed: 02/23/2023 No. 21-20447 161, 172–73 (5th Cir. 2010); Concorde Limousines, Inc. v. Moloney Coachbuilders, Inc., 835 F.2d 541, 549–50 (5th Cir. 1987). We do so here. 20 VI. The district court’s judgment is AFFIRMED. The case is REMANDED solely to allow the district court to determine whether Chase should receive prejudgment interest. 20 Chase’s primary authority is distinguishable. See Farmland Indus., Inc. v. Andrews Transp. Co., 888 F.2d 1066 (5th Cir. 1989). There, the district court had already awarded prejudgment interest, but both parties agreed that it applied an incorrect interest rate. Id. at 1068. 22
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
