REPORT AND RECOMMENDATION

Re: ECF No. 131

MAUREEN P. KELLY, Chief Magistrate Judge.

I. RECOMMENDATION

Before the Court is Plaintiffs' Motion for Application of Ohio Law, ECF No. 131, in this class action stemming from a data breach. For the reasons that follow, it is respectfully recommended that the Motion for Application of Ohio Law be granted in part and denied in part.

II. REPORT

A. FACTUAL AND PROCEDURAL BACKGROUND

Plaintiffs1 initiated this class action on behalf of a putative class of financial institutions that "suffered, and continue to suffer, financial losses as a direct result of Wendy's conscious failure to take adequate and reasonable measures to protect its point-of-sale and computer system." ECF No. 32 ¶ 1. Defendants are comprised of The Wendy's Company, Wendy's Restaurants, LLC and Wendy's International, LLC (collectively, "Defendants" or "Wendy's"). Id. ¶¶ 43-45.

In the Complaint, Plaintiffs make the following factual allegations. Plaintiffs are issuers of credit and debit cards to customers. Id. ¶ 55. When such customers use their cards to make purchases at Wendy's restaurants, Wendy's stores customer payment card data in its computer systems. Id. ¶ 58. Beginning in or about October 2015, computer hackers used the credentials of third-party vendors to install malware through which they were able to steal the payment card data of Wendy's customers from at least 1,000 restaurants. Id. ¶ 62. Wendy's had knowledge of a data breach in December 2015. Id. ¶ 63. By January 2016, unauthorized charges to Wendy's customers' card were underway. Id. ¶ 64.

Plaintiffs First Choice Federal Credit Union, AOD Federal Credit Union, Tech Credit Union, Veridian Credit Union, South Florida Educational Federal Credit Union, Preferred Credit Union, Alcoa Community Federal Credit Union, Associated Credit Union, Envista Credit Union, Federal Deposit Insurance Corporation, Receiver for First NBC Bank,2 Navigator Credit Union, The Seymour Bank, Financial Horizons Credit Union, Nusenda Credit Union, Greater Cincinnati Credit Union, KEMBA Financial Credit Union, Wright-Patt Credit Union, and Members Choice Credit Union, on behalf of themselves and all others similarly situated, comprise a sub-group designated in the Complaint as the "FI Plaintiffs." Id. ¶¶ 13-35.

Plaintiffs Credit Union National Association, Georgia Credit Union Affiliates, Indiana Credit Union League, Michigan Credit Union League and Ohio Credit Union League, associations that represent the interests of their member credit unions, comprise a sub-group of Plaintiffs designated in the Complaint as "Association Plaintiffs." Id. ¶¶ 36-42.

Plaintiffs filed the operative Consolidated Amended Class Action Complaint ("the Complaint") on July 22, 2016. ECF No. 32. In the sixty-five-page Complaint, Plaintiffs raise claims of negligence, negligence per se, violation of the Ohio Deceptive Trade Practices Act as well as seeking declaratory and injunctive relief. Id.

Defendants filed a Motion to Dismiss on August 22, 2016. ECF No. 53. Ultimately, that Motion to Dismiss was denied and the choice-of-law dispute raised therein was deferred to a later stage of the litigation. ECF No. 88.

FI Plaintiffs filed the instant Motion for Application of Ohio Law and supporting documents on January 19, 2018, and January 23, 2018. ECF Nos. 131-134. Defendants filed a Response in Opposition to the Motion for Application for Ohio Law and supporting documents on February 19, 2018, and February 20, 2018. ECF Nos. 139-140. FI Plaintiffs filed a Reply Brief on March 21, 2018. ECF No. 141. On April 11, 2018, Defendants filed a Sur-Reply. ECF No. 145. The Motion for Application of Ohio Law is now ripe for consideration.

B. LEGAL PRINCIPLES

To determine whether Ohio law should be applied to the claims raised in the instant case, the Court must apply the choice of law rules of Pennsylvania, this Court's forum state. See Auto-Owners Ins. Co. v. Stevens & Ricci, Inc., 835 F.3d 388, 403 (3d Cir. 2016).

As this Court has recently explained:

Axiall Corp. v. Descote S.A.S., Civ. A. No. 15-250, 2018 U.S. Dist. LEXIS 15303, at *32-34 (W.D. Pa. Jan. 30, 2018).

Further, the choice of law analysis is issue-specific. Berg Chilling Sys. v. Hull Corp., 435 F.3d 455, 462 (3d Cir. 2006). In a single case, different states' laws may apply to different issues. Id. Accordingly, each claim must be evaluated separately.

C. DISCUSSION

1. Identification of Jurisdictions

In the first step of the choice of law analysis outlined above, the Court identifies the jurisdictions whose laws might apply. Axiall Corp., 2018 U.S. Dist. LEXIS 15303, at *32. In this case, FI Plaintiffs seek to apply the laws of Ohio. Defendants seeks to apply the law of each FI Plaintiff's home state. For the FI Plaintiffs located in Ohio (Wright-Patt Credit Union, Greater Cincinnati Credit Union, and Kemba Financial Credit Union, ECF No. 32 ¶¶ 30, 31, 41), Defendants do not object to the application of Ohio law. ECF No. 139 at 4 n.1. However, for the remaining FI Plaintiffs, Defendants seek to apply the laws of these plaintiffs' respective homes states; specifically: Alabama (AOD Federal Credit Union, ECF No. 32 ¶ 14); Arkansas (Alcoa Community Federal Credit Union, id. ¶ 19); Florida (South Florida Educational Federal Credit Union, id. ¶ 17); Georgia (Associated Credit Union, id. ¶ 20); Indiana (Tech Credit Union, id. ¶ 15); Iowa (Veridian Credit Union, id. ¶ 16); Kansas (Envista Credit Union, id. ¶ 22); Louisiana (First NBC Bank, id. ¶ 23); Michigan (Preferred Credit Union, id. ¶ 18); Mississippi (Navigator Credit Union, id. ¶ 25); Missouri (The Seymour Bank, id. ¶ 26); Nevada (Horizons Credit Union, id. ¶ 27); New Mexico (Nusenda Credit Union, id. ¶ 29); Pennsylvania (First Choice Federal Credit Union, id. ¶ 13); and Texas (Members Choice Credit Union, id. ¶ 34).

2. Existence of Conflicts

As set forth above, the Court must next examine the substance of the identified states' laws, and look for actual, relevant differences between them. Axiall Corp., 2018 U.S. Dist. LEXIS 15303, at *32-33. Then, if there are actual, relevant differences between the laws, the Court will classify the conflict as true, false, or an unprovided-for situation. Id. at *33. In this case, Plaintiffs bring claims of negligence, negligence per se, and violation of the Ohio Deceptive Trade Practices Act. ECF No. 32 at ¶¶ 164-200.3

a. Negligence

In Count I of the Complaint, FI Plaintiffs allege that Defendants breached a duty to use reasonable care in safeguarding payment card date and a duty to notify them of any breach in a timely manner. ECF No. 32 ¶ 165. The parties agree that a conflict exists between Ohio and the other states as to the application of the economic loss doctrine to the negligence claim. However, FI Plaintiffs argue that the conflict does not arise in this case.

"Broadly speaking, the economic loss doctrine is designed to maintain a distinction between damage remedies for breach of contract and for tort. The term `economic loss' refers to damages that are solely monetary, as opposed to damages involving physical harm to person or property. The economic loss doctrine provides that certain economic losses are properly remediable only in contract." Giles v. GMAC, 494 F.3d 865, 873 (9th Cir. 2007).

The parties agree that Alabama, Arkansas, Florida and Mississippi do not recognize the economic loss doctrine. ECF No. 132 at 34; ECF No. 139 at 18. They further agree that Ohio employs the economic loss doctrine in negligence cases. Id.

FI Plaintiffs argue that there is no conflict in this case, however, because the economic loss doctrine does not apply in this case because: (1) they have suffered property damage; (2) Defendants breached an independent duty, which constitutes an exception to the economic loss doctrine. ECF No. 132 at 33-34; 34-35.

FI Plaintiffs base their argument on two unsubstantiated legal conclusions.

(1) Property damage

First, citing only to an argument they made in the litigation of the earlier Motion to Dismiss, FI Plaintiffs assert that they have suffered property damage where "[t]he integrity of FI Plaintiffs' computer data was compromised and rendered commercially useless for the purpose for which it was intended." ECF No. 132 at 34. In disposing of the prior Motion to Dismiss, this Court held that "[a]lthough the Court is far from convinced of Plaintiffs' theory, it is not implausible that computer data could be considered property," ECF No. 80 at 5 (adopted at ECF No. 88). This Court did not find that FI Plaintiffs suffered property damage.

Further, a recent decision from the United States Court of Appeals for the Sixth Circuit applying Ohio law calls such a legal determination into question. In City of Cincinnati v. Deutsche Back Nat'l Trust Co., 863 F.3d 474, 477 (6th Cir. 2017), the Sixth Circuit applied Ohio state law and the economic loss doctrine to bar a tort plaintiff from recovering purely economic loss that did "not arise from tangible physical injury" to persons or property. It is not apparent to this Court that the loss of usefulness of computer data could constitute an injury to property that is either tangible or physical. Thus, for purposes of the instant Motion, this Court will not accept FI Plaintiffs' assertion that the economic loss doctrine is inapplicable to this case on the basis that FI Plaintiffs have suffered property damage.

(2) Independent duty

Similarly, citing their prior brief and this Court's ruling on the Motion to Dismiss, FI Plaintiffs assert that they have "demonstrated an independent duty of [Defendants] to protect sensitive financial and personal information that would bring [FI] Plaintiffs' negligence claims within the independent duty exception, and thus the [economic loss doctrine] would not apply." ECF No. 132 at 34-35. In Ohio, "the economic [loss] rule does not apply—and the plaintiff who suffered only economic damages can proceed in tort—where the defendant breached a duty that did not arise solely from a contract." Campbell v. Krupp, 961 N.E.2d 205, 211 (6th Cir. 2011).

Again, although this Court found, in disposing of the Motion to Dismiss, that FI Plaintiffs had advanced a plausible claim for negligence, ECF No. 80 at 7, this Court did not find that FI Plaintiffs had established an independent duty on the part of Defendants. Defendants argue that the relevant states have differing laws as to the existence of the claimed duty. ECF No. 139 at 18; ECF No. 139-5 (summarizing relevant states' laws concerning duty). Recognizing the uncertain and evolving nature of this legal concept, for purposes of this Motion, this Court will not accept FI Plaintiffs' assertion that the economic loss doctrine is inapplicable to this case on the basis that Defendants have an independent duty to protect sensitive financial and personal information.

Thus, having declined to accept the two bases of FI Plaintiffs' argument as to the inapplicability of the economic loss doctrine, this Court is left with the parties' agreement that a conflict exists as to application of the economic loss doctrine to negligence claims in the relevant states.

The Court has little difficulty finding this conflict to be a true conflict. If Ohio law applies, FI Plaintiffs' negligence claim could be precluded pursuant to the economic loss doctrine, thereby impairing the interests of those states whose laws do not limit their citizens' recovery. Conversely, if those states' laws apply, Ohio's interest in limiting the liability of its citizens would be impaired. See Panthera Rail Car LLC v. Kasgro Rail Corp., 985 F.Supp.2d 677, 696 (W.D. Pa. 2013) ("A true conflict exists when the governmental interests of [multiple] jurisdictions would be impaired if their law were not applied.") (citation and quotation marks omitted).

b. Negligence per se

In Count II of the Complaint, FI Plaintiffs allege that Defendants' actions in failing to use reasonable measures to protect payment card data and in failing to comply with applicable industry standards violated of Section 5 of the Federal Trade Commission Act ("FTC Act") and "similar state statutes," and thus constituted negligence per se. ECF No. 32 ¶¶ 174-180.

FI Plaintiffs concede that there is a true conflict between Ohio law and Arkansas and Louisiana law as to negligence per se because the latter states do not recognize negligence per se. ECF No. 132 at 34 n.7. Defendants argue that, in addition, there is a true conflict between Ohio law and the laws of Alabama, Georgia and Mississippi because those states do not limit negligence per se to statutes that contain express private rights of action. ECF No. 149 at 38-39; ECF No. 139-7 (summarizing relevant states' law concerning negligence per se). Section 5 of the FTC Act does not contain a private right of action.

In any event, as the parties agree, there is a true conflict of laws as to this claim.

c. ODTPA

In Count III of the Complaint, FI Plaintiff allege that Defendants violated the Ohio Deceptive Trade Practices Act ("ODTPA"), Ohio Rev. Code §§ 4265.01 et seq., by misrepresenting the security of their point-of-sale payment systems. ECF No. ¶¶ 181-200.

FI Plaintiffs concede that there is a true conflict between the ODTPA and the consumer protection laws of the other relevant states. ECF No. 132 at 34 n.7. Defendants characterize the conflicts as "widespread and cover[ing] all facets of a consumer protection claim," "including pre-suit notice requirements, the requisite elements of the offense and the remedies available." ECF No. 139 at 19, 40; ECF No. 139-8 (summarizing relevant states' consumer protection laws).

Indeed, the United States District Court for the Eastern District of Pennsylvania has explained that "courts in this circuit confronted with proposed multi-state consumer protection classes have concluded that the laws vary in significant ways." Vista Healthplan, Inc. v. Cephalon, Inc., Civ. A. No. 06-1833, 2015 U.S. Dist. LEXIS 74846, at *101-102, 105-106 (E.D. Pa. 2015) (citing Karnuth v. Rodale, Inc., 2005 U.S. Dist. LEXIS 14426, at *13 (E.D. Pa. July 18, 2005); Lyon v. Caterpillar, Inc., 194 F.R.D. 206, 219 (E.D. Pa. 2000); BMW of N. Am., Inc., v. Gore, 517 U.S. 559, 568-69 (1996)). In Vista Healthplan, the Court also analyzed the consumer protection laws of multiple states and to illustrate the "many varying elements and nuanced articulations that distinguish the state protection laws" and the impossibility of distilling the laws into a core set of elements. 2015 U.S. Dist. LEXIS 74846, at *102-106.

As the parties agree, there is a true conflict of laws as to this claim.

3. Weighing of Contacts and Interests

As set forth above, if a true conflict exists, the Court must then determine which of the conflicting jurisdictions has the greater interest in the application of its law by weighing the relevant contacts on a qualitative scale according to their relation to the policies and interests underlying the particular issue. Axiall Corp., 2018 U.S. Dist. LEXIS 15303, at *33-34. "The relevant contacts are the place of injury, place of conduct, domicile of the parties, and the place where the relationship between the parties is centered." Vurimindi v. Fuqua Sch. of Bus., 435 F. App'x. 129, 135 (3d Cir. 2011) (citation and quotations marks omitted).

a. Contacts

(1) Place of injury

It is undisputed that the alleged injuries, expenses incurred by and fees lost by FI Plaintiffs, ECF No. 32 ¶¶ 173, 180, 196, occurred in the states in which FI Plaintiffs have their principal places of business. ECF No. 132 at 40-41; ECF No. 139 at 30-31.

FI Plaintiffs assert that because the alleged injuries occurred in multiple states, this factor carries little weight and greater weight should thus be given to the place where Defendants' conduct occurred. ECF No. 132 at 40-41. Defendants suggest that the place of injury is of substantial significance. ECF No. 139 at 30.

As this Court has previously held, "when the injury occurred in two or more states, or when the place of injury cannot be ascertained or is fortuitous and, with respect to the particular issue, bears little relation to the occurrence and the parties, the place where the defendant's conduct occurred will usually be given particular weight in determining the state of applicable law." ClubCom, Inc. v. Captive Media, Inc., Civ. A. No. 07-1462, 2009 U.S. Dist. LEXIS 7960, at *23 (W.D. Pa. Jan. 31, 2009) (quoting Restatement (Second) Conflict of Laws § 145 cmts. e, f.) Due to the multiple locations of the alleged injuries, this factor weighs in favor of applying the law of the place of Defendants' conduct.

(2) Place of conduct

As to this factor, the place where the conduct causing the injury occurred, the parties differ. FI Plaintiffs assert that Defendants' conduct relating to the security of its point-of-sale systems arose in Ohio, where their IT and data security team is based. ECF No. 132 at 31. Defendants argue that the injurious conduct was not effected by Defendants, but by the hackers who installed malware on the point-of-sale systems of the restaurants, most of which are located in FI Plaintiffs' respective home states. ECF No. 139 at 31.

Defendants' argument is inapposite. The instant suit is not based on the hacking incident itself, but rather on the actions and inactions of Defendants in safeguarding payment card data which was compromised in the hacking incident.

The Court finds sufficient support for FI Plaintiffs' premise that the alleged actions and inactions of Defendants at issue in this case took place at Defendants' headquarters in Ohio. Accordingly, this critical factor weighs in favor of the application of Ohio law.

(3) Domicile of parties

FI Plaintiffs reside in the above-listed 16 states, including Ohio; Defendants reside in Ohio. ECF No. 32 ¶¶ 13-35; 43-45; ECF No. 132 at 42; ECF No. 139 at 31. This factor does not weigh in either side's favor in the instant determination.

(4) Place where parties' relationship is centered

The parties agree that they do not have any direct relationship. ECF No. 132 at 42; ECF No. 139 at 32. Thus, this factor does not carry any weight in the instant determination.

b. Outcome

(1) Negligence and negligence per se

As is clear from the analysis above, a weighing of the relevant factors in this case reveals that the most significant contact is the place of the alleged conduct, i.e., Ohio. Thus, it appears that the application of Ohio law is appropriate. Accordingly, it is recommended that the instant Motion for Application of Ohio Law should be granted as to the claims of negligence and negligence per se.

(2) ODPTA

The outcome differs as to the ODPTA claim, however, due to the nature of the statute upon which it is based. As multiple courts have found, a single state's consumer protection statute, like the ODTPA, which is designed to protect consumer residents of the state in which it was promulgated, should not be generally applied to an action involving plaintiffs from multiple other states. In re Bridgestone/Firestone Tires Prods. Liab. Litig., 288 F.3d 1012, 1018 (7th Cir. 2002) (holding that "[s]tate consumer-protection laws vary considerably, and courts must respect these differences rather than apply one state's law to sales in other states with different rules"); Gray v. Bayer Corp., Civ. A. No. 08-4716, 2011 U.S. Dist. LEXIS 79498, at *17 (D.N.J. July 21, 2011) (declining to apply New Jersey Consumer Fraud Act to putative nationwide class finding New Jersey's particular balance between consumer protection and the promotion of business within its borders should not displace the policy goals of other states); Lyon, 194 F.R.D. at 213 (holding that Pennsylvania consumer fraud act is not universally applicable to putative nationwide class); Vista Healthplan, 2015 U.S. Dist. LEXIS 74846, at *110-111 (holding state where consumer is harmed has greatest interest in application of state consumer protection law).

Accordingly, it is recommended that the instant Motion for Application of Ohio Law be denied as to the ODTPA claim insofar as it is brought by FI Plaintiffs not located in Ohio.

D. CONCLUSION

For the foregoing reasons, it is respectfully recommended that FI Plaintiffs' Motion for Application of Ohio Law, ECF No. 131, be granted as to the claims for negligence (Count I) and negligence per se (Count II) and denied as to the claim filed pursuant to the ODPTA (Count III) insofar as it is brought by FI Plaintiffs not located in Ohio.

In accordance with the Magistrate Judges Act, 28 U.S.C. § 636(b)(1), and Local Rule 72.D.2, the parties are permitted to file written objections in accordance with the schedule established in the docket entry reflecting the filing of this Report and Recommendation. Failure to timely file objections will waive the right to appeal. Brightwell v. Lehman, 637 F.3d 187, 193 n. 7 (3d Cir. 2011). Any party opposing objections may file their response to the objections within fourteen (14) days thereafter in accordance with Local Civil Rule 72.D.2.