included a putative class of banks specifically the putative class reps include a small community banks and credit unions so i have a question about that though if the problem here is in the security of the payment system of the groceries chain it's using why wouldn't you potential class include virtually everyone in the world who's issued of these a card or a master card you go to france and have them locked and you know it's a visa that's all that's a pretty big class it may indeed your honor i simply represent the banks that issued the cards that were affected that's the class that we seek to represent there were two points but you know i don't quite understand what you mean so if the so these banks had particular customers who shopped at these stores and that's how you and you trace those cards back to these particular bank yes it's estimated that two point four million cards were affected right right so that is the class if you will well it's quite more narrow than that but those really affected cards on narrower class would be those banks that issued those cards discovery would reveal that those shrink you your honor and so you know getting right to it then and thank you for the question what happened here was in december of two thousand and twelve markets security system was breached it was breached for the period of about one hundred nineteen days the last two weeks of which little more chinooks knew that this breach occurred but notified no one so given all of that i mean we've certainly seen cases in which the customers have somebody like schnucks have brought this kind of action but it looks to me and your opponents argue that the network of contracts that allow the payment process to happen contracts between you know the merchant and its bank and over to the issuing bank and over to you and they even say in their brief that maybe you can comment on this  oh no no one is is free and here you're coming along not as a customer but saying we want even more reimbursement i understand your honor and i'm very well aware of that and i have several things to say it was a joint first of all did you find that statement in the red brief an accurate depiction of the way i know i find his books i find it a mere characterization there's nothing in the record on that issue that's a mere characterization record here is w and that is that my clients are not party to any contract with the defendant of course not but that's why judge would was asking about the network of contracts we're not talking here about strangers we're talking about some of the most sophisticated elaborate networks a contract in the modern global economy i understand i view that your honor as a little bit of a red herring because again those contracts though mentioned they're not in evidence they're not part of the record here they presented to the district court there was a excerpts from various contracts of not complete contracts included us agree with what was and presented to this record i disagree with it to the extent that it's copies of those contracts but they have to be given to you they have not with us you know what i'd stick that i'm not one hundred percent sure that they may they may have given those to my sosia but they're not they're not  to the banks that issue cards to its customers right right we want to worry about this fire remember correctly your list from the illinois supreme court it's for see ability of harm your likelihood of harm consequences of putting the burden on the defendant and the magnitude of that burden all kind of least cost avoidance  sorts of issues that we're familiar with from one l classes and torkel right certainly the last two elements yes so those all seem to be issues that we were talking about complex economic activity can be addressed by contract we turn to tort law when we're talking about externalities costs on third parties on strangers were strangers here well there i think what you're getting to is the relationship between the parties which is another consideration and i was at the economic last opteron which is the domain i mean this chaos well but it doesn't apply here for the reasons we've outlined in our brief and that is that we're talking about a service here not a product so there's no qualitative defect product at issue there's a service there's no contract that governs duty between these parties because these parties do not have contracts that's why these these extra contracts which in this network that they mention is a little bit of a red herring there may be those agreements they're not part of the record here but there's certainly no contract between my class of plaintiffs and the defendant so let's let me let's let's talk about something a little less novel than data breaches but a situation that seems at least roughly similar to me in this choice between contract and toward or some combination of the big construction project the h b a see sub sub contractor on a big project may or may not have any contractual relationship with the people who are going to be doing the roofing down the line or who knows that they're not going to be direct contractual relationships we know that if one sub contractor really screws up  job it's doing it's going to be it is very likely to cause for seeable arm to a bunch of other people involved in that project right now and we don't do that by tort law we do we handle those issues through contract law right well you know it's hard for me to say in your hypothetical whether we do or we do not take my word for it those are those never never will take you take a look at any big construction project dispute ok if you have something like in your hypothetical is are all of the parties contracting parties with one another because again my client is not contract one so and so contractor does not have a direct contract with a sub sub contractor in another profession but they're all part of this network of contracts so forgive me i'm not understanding how parties that have no contract with one another will resolve their dispute contractually through the indemnification provisions that sort out the kinds of risks that are foreseeable and substantial in this big complicated voluntary economic activity they undertake so i guess my response would be it sounds like the devil is in those details but we don't have those details and don't be so council we don't have those contracts to go back to the very first part you're saying well you don't don't know but in the end i mean the very first thing is is there any damage and in talking about this system of contracts and indemnification which your opponent referred to part of it is a duty and part of any basis for bringing your claim is  have i could represent to the court they have not been indemnified ok that has not happened if you can accept my representations again that's not part of the record everything we're talking about is not part of the record to your point about damages we have allege damages we suffer damages they are the cost of reissuing cancelling all cards reissuing two point four million cards and the cost associated with that which is not small in addition even the costs of the cards that were actually compromised and accessed again not just in significant cost there was consumer litigation back there was nobody else for the consumer litigation in that litigation the damages were estimated to be somewhere in seventy million dollars so there are significant damages here because my clients are the ones that ate those costs my specific client community bank of tretton has not been indemnified but it still doesn't answer why this isn't something that you already have handled through this network of contracts through the share that you get for the cost of processing credit transactions you know the banks that issue credit cards are not  the charity business you know they do this because they earn money from the cards whether it's through merchant fees or whether it's through interest or whether it's through you know annual assessments that are depriving you of ways that cards  bring money home to the issuer and your coming in and saying that somehow this network of contracts isn't enough and i have the same questions in my mind about the use of the tort system versus contract the judge hamilton was talking about i also would like you for a minute to discuss your subclass that is raising a claim under the illinois consumer fraud and deceptive business practices act because there's got to be some link at businesses like this are persons as defined under that act right but the illinois courts have said for a non consumer to have a cause of action you've got to show conduct that implicates otherwise somehow or another i'll just rephrase implicates consumer protection because sounds and it seems it's as though the consumers are taking advantage of those tools for themselves there's almost a double coverage problem if you're trying to get out there and protect the consumers and they're out there getting a multi million dollar you know tens of millions of dollars in settlement you know at some point there's there's duplication and the real essence of your complaint is business l well i would suggest that they're intertwined your honor forgive me if i misled the court and created the assumption that the consumers have recovered seventy million dollars they have not under decisions like spokeo and the like of course we know that they only have standing to bring cases where there are actual injury where the banks have eaten most of that cost their actual injury is smaller if any in some instances so and in a sense to the banks already insure themselves against this a consumer fraud case because the interest of the consumer are intertwined with the bank they are together they are serving the interest of their patrons by issuing them a card that has both proprietary information of the banks and unique identifying information that belongs to the consumer on the car both are being stolen by the way when the data breach a curse account numbers that belong to the bank social security numbers the blow to the consumer so there is an intertwined interest of both consumers and banks in this set of facts which are not bringing your case and we have consumers i was involved in the consumer litigation that has resolved this skewed quickly about your theory under the illinois personal information protection act yes your my basic question is how you alerted judge reagan that you actually were relying on that larry as you know under twelve b six in pleading case my question is not whether you played it sufficiently my question is whether you argued it to judge reagan well i don't know that we argued it well we did argue the only consumer fraud act and all and you well i mean the facts support it i mean whether i source in general i would like look there's a general rule in our adversarial system we expect counsel to make a coherent legal argument if they expect the court to address and i didn't see it in your district  that name but the facts as i mentioned earlier where the consumer information in the bank information is intertwined proprietary information by the bank i e the account numbers proprietary if you will information of the consumer i e so security numbers tasking a lot of the district judge to dream up whatever legal theories the facts suggest without any help from counsel once the twelve the six motion has been filed we ask the court to do only what it's broad statute and as mr driscoll just pointed out it refers to any person who suffers actual damage these data breaches certainly did take money out of the pockets of the banks that issued the cards because they're all sorts of things and so you've got to pay their things and say you know you're going to make your customers good for this and it's easy for me to see the joint interest in a joint interest in getting  to put best practices in place follow the visa guidelines in the master card guidelines because everybody wins if they do that and there may actually almost be a moral hazard for the grocery store chain or the anybody any merchant if they don't suffer any financial damage well your honor i think the moral hazard issue is taken care of him her by the network in a related contracts that you were discussing earlier and under which she works and then the other merchant has certain responsibilities but that's what i was asking about what you said at page three and four of your brief you left me with the impression you say the card brands i'm not sure what that means of these a network use the card brand the car the car brand and both sides i think use the same terminology refers to the visa and master card respective networks ok so plane use the issuing banks are going to credit the kind of their customers accounts i understand it that's been the law for a long time correct so they're out you know a million dollars i'll just use a simple number because they credit the customer accounts at that point are you telling me that these are pays the issuing bank a million dollars to cover the cost of the consumer protection under the rules that these are issues in that master card separately merchant correct in this case it was citi corp so visa goes to the acquiring bank city corp here and says give us a million dollars because we'd like to give it back to the issuing bank which has made the customers good under the rule under the rules they have the ability to go this the kind of thing that ought to be handled a summary judgment as opposed to twelve b six in our view your honor no because it doesn't really matter what the details of those arrangements are what matters i believe is that those arrangements exist why does it not matter that the details are there because you're trying to piggyback on consumer protection concerns that flowed from this data breach and if there are any if it says judge but both suggested maybe there's no real injury at all to the financial institutions maybe there is you know but don't we need to explore that well only if there is a a cause of action here you're earning and what  and common law negligence claim go there isn't one because there is no duty to safeguard personal information in the dirt illinois or missouri coney the court said it was citing only supreme court precedent where there is no duty there is no negligence the plaintiffs approach this would actually turn that proposition on its head by basically saying wherever there is negligence there must be a duty but there is a duty under the owner of consumer fraud act not to engage and among other things you know deceptive business practices we have this two week period why isn't that something that at least as to those banks that are in illinois under the protection of that law why shouldn't that go forward the jurisdiction of the consumer fraud statute in illinois is limited to cases th meaningful consumer nexus right and that's what i'm saying why doesn't this has a meaning have a meet the bank and the consumer absolutely aligned in their interest in having the merchant follow the visa rules or the master card rules for data protection i think the simple answer to that question your honor is that the consumers have already been reimbursed and for that you don't need to go outside the record let's suppose they were not would you think the consumers might have a c compete on the basis of keeping data secure this point yet you know i'm certain that one of you know among the many cases that were empty yalit in the consumer litigation here they certainly have the opportunity to raise claims under that act or in other states we've recognized harms beyond the fact that maybe you have a felony hundred dollars charge on your your visa we noted that people have to spend a lot of time they need to change automatic payments they need to take other measures maybe they need to try to kind of protection service so what they've been fully reimbursed by the fact that they're not stuck with the phony charge is a different question was looking at the complaint in this case in paragraph eighty the plaintiff alleges with referring to themselves as issuing banks and i'm quoting from paragraph eighty there is no other foreseeable group of parties that could be injured by a data breach leave the bag and yet they are voluntarily participating in a network that is heavily regulated by contracts yet it was late with that or they really are left holding the bag why can't they seek indemnification from the party whose carelessness led this whole thing to happen that they had they claim they are left holding is one if it exists at all as one that they bargained for as being when they chose to be part of that network i think we can assume they're left holding the bag here i mean crooks made off with millions of dollars in fraudulent charge and train that la fall somewhere or lost somewhere in the end the way in which that has been beat it out among all the different participants in this network has been regulated by the car brands and that includes a number of arrangements that have been agreed to here so obviously banks are are certainly paying their customers for their fraudulent charges on their credit cards and their debit cards but they're also receiving from visa master card at least the way the system is set up in this area those standards whatever they are is it your theory mr warren that your client has any legal duty to comply with those standards yes and under what sort and that is in the master services agreement between struck c and its acquiring bank which was citi corp which is part of the record before you it one point plaintiffs were breaking a third party beneficiary argument with respect to that contract they have dropped that for the purposes of this appeal as part of the record and that contract requires snooks as a merchant to comply with the car brand rules the car ground rules set forth the p c i d s s data security standards for the payment card industry so who can sue schnucks when they don't do that they allegedly failed to comply with these rules well that's what the complaint is certain yet now who did sue them all the consumers the consumers into why couldn't we turn to that primitive the illinois personal information act now that that that to lay a notice the two weeks it does say the information has to or the duty is to the owner or licensee of the information here are not owners or licensees that's correct they they are not they they they are banks that issued cards to those people ok surely they have an interest in the integrity of their cards happen you say they don't own any of the information on the card well they don't have the the car belongs to the person to whom they are shooting but it has a number one number yeah it has bank account number probably has other bank identifying information otherwise it wouldn't work as a card when you either in the course this is the preach ship era which is another thing but when you swipe the card it's in coding bank information just as much as it's in coding individual information or you would never know which bank to go to it does have that information yeah yeah yeahs you know as you pointed out during the previous argument this is not a claim that was raised but it's not easily suggestible by the allegations that were was at all times and i'm paraphrasing slightly obligated by contract to comply with the card grammar rules and to comply with p c i d s s food security standards and it's very hard isn't it accepted these master rights so they are relying on the contractual obligation which notes he has as part of this network but they are also arguing that the duty to exercise prudence with respect to their card accepting practices that that that's all somehow a service and so it's an extra contractual duty and so it falls outside the scope of economic laws they are arguing that and i don't think that argument holds water strikes is not in the business of providing data security service or vera grocery they sell not intangible products they sell food so why would anybody come into schnucks with anything but cash i mean you know that would really limit your market today there's some people don't know what cash is universe of people who are willing to go to your store because a great number of people don't like carrying around huge amounts of cash them in certainly you know there's no dispute that merchants choose to participate in this network just like the founded in the contract well that duty maybe that's why i keep going back to the illinois statute i think you need to convince us that there isn't at least that and nothing of an implicit consumer interest at this to bring it into this rather wide language like i'm in the bank one milwaukee and sanchez case for example the illinois pellet court says the statute covers conduct that involves trade practices that otherwise implicate consumer protection concerns and seems to me pretty unrealistic to say that this is not such a practice you are you started off by referring to a potential moral hazard and i responded by saying there is a heavily regulated contractual network here that deals with that and not to mention all of the consumer lawsuits that shows have to fill why and that maybe illinois wanted belt and suspenders they passed this statute where they should have or not so i think we have to deal with the complaint as pl pled all of that all of the losses that the consumer suffered have already been reimbursed by these plaintiffs and that's what they say in paragraph eighty eight and therefore they as a as businesses as banks that include potentially are that's not the question it is is this a trade practice that implicates consumer protection concerns it's not now that we've identified those concerns have they been addressed i think that too would be for later on  surely a practice that implicates in the end if it was being raised by the consumers then that would be the direct point is how that gets away from the fact that the illinois law sometimes lets businesses sue that's what this whole doctrine is all about if you're a consumer anyway you don't have to jump through all those hoops and yet you know the outcome of this case is not going to have any effect on those consumers unless one wants to engage in sort of an attenuated you know well if the outcome of the case is to induce merchants to take seriously their obligations to have credit have data security then consumers are certainly benefited by the litigation well i think if they're the front line people benefited by the litigation but all those it issue here with respect to their own damages had gone way beyond that they're talking about you know people have to spend time processing new cards and the cost of issuing two point three million new cards and all this other stuff way beyond just that we had to pay somebody to t to reimburse the issuing banks shook's is a pretty big operation writes about five states right yes and it's one hundred some odd stores correct law so in other merchants are so have the same incentive established by the significant liabilities say faced by consumers who are in a much more appropriate position to raise consumer product concerns that may be but if illinois has decided to open the door further then it's not really up to us to shut it and you know we have not seen cited by the plaintiff any case law that was suggest you can go this far i mean you can always find a consumer interest in any business dispute because at the end of the day there's going to be some customer for some businesses dealing with those entities and that is the case here as it would be in any other business litigation but this is business litigation this is litigation over who has to pay the consumers not whether the consumers get paid but who has to pay them and i don't think that's an appropriate place to impose consumer fraud liability or you would lose any meaning to this requirement of consumer nexus comply with p c i standards and the fact that the only duty that they are claiming that is not reached his essentially the duty to comply with the standards is that i take it the record doesn't tell us whether one of these potential assessments was ever economic loss rule applies even under their version even under their interpretation which i think is correct you mean they basically say you know in the way in missouri the economic loss rule does not apply any time there is a duty independent of contract in fact the economic loss was much more expansive than the out in both illinois and missouri but even if the standard is as it would be were as they say they don't meet it because the duty that they are alleging was breached here is  that is found in the contract by their own allegations and in fact that in paragraph one thirty seven of their complaint they've asked the courts this court in the district court to issue an injunction that would require schnucks to comply with those car brand rules and those contracts and the standards that are set forth in those contracts so the whole if you look at the congregation of the passion case in illinois from the supreme court or this court's cases interpreted that the whole reason for allowing a party to plead around the economic loss rule is if there is a professional service provider well sure i mean if you're a lawyer you know yes you have a contract with your client but you have other obligations from it's hard to spell out in that contracts or it means to be a good lawyer here we don't have that situation the p c i standards are written down they claim that we didn't follow them and that's a contract based judy on which they are trying to or from which they're trying to extract remedy and i think that's the basic problem with this case as it relates to the common law claims as a relates to the consumer fraud tax actually i would just ask the court to consider where do you end up drawing the line and what and what isn't a very clear to me that the defendant is trying to wrap everything into these contracts contracts again that are not part of the record here at twenty six they're referred to all over the place in the complaint they are but the my clients may have on the ball aspect to it we're going to talk about all these contracts but you not tell the court what they say usually contracts like that are appended to the complaint insurance policies are you know this kind of contract well again your honor things are getting conflated i'm afraid there is no contract between my clients and the defendant they know that we know they are searching right and so my client may have contracts with many parties that  know maybe they apply maybe they don't the the singular point is that they're not part of the record here we don't know what they say whether they apply what they cover what they don't maybe they cover losses here maybe they don't maybe their collateral source to be considered maybe they're not these things will reveal themselves once the case proceeds now is it your position that once all was said and done at against the backdrop of all this litigation what's happened that the consumers the actual people who went to the grocery store to buy food have been made whole and in the wake of this breach well that's a subjective thing i guess i mean there has been a settlement a consumer settlement in the city of st louis  participated in i know there was some opt out litigation that followed that i mean it would be you know it's hard for me to answer whether they've been made whole or not yet i did want to mention and w payment services the benefit they received was they make two billion two point seven billion in revenue annually you know so that his gross revenue the unjust enrichment a portion a portion of gross revenue services provided by my clients their gross revenue so given whatever portion of it is a benefit a nerd to share every payment the grocery shopper made with  people paying their bills when they reach the checkout stand i'm sorry or said welcome to money that they're getting through the cards they don't really care actually they probably rather get it in cash because then they get about three percent more depending on what the merchant enrich at the expense of the consumer by receiving that card by but at the same time putting the consumer at risk by not safeguarding that information by implementing you know you being very has been met with some skepticism in cases because you know the idea that you the consumer are factoring in the integrity of the payment system is pretty farfetched actually well maybe another way of putting down your honor is hedged notes notified consumers that their payment processing system had been hacked for that two weeks that it knew it that would consumers patronize them yes i think if it's a reasonable person would say no