JOHN A. ROSS, District Judge.
This matter is before the Court on Defendants' Motion for Partial Reconsideration of the Court's January 15, 2015 Order granting Plaintiff's partial cross-motion for judgment on the pleadings, filed pursuant to Fed.R.Civ.P. 54(b). (Doc. No. 84) Alternatively, Defendants move for leave to amend their pleadings pursuant to Fed.R.Civ.P. 15(a)(2). The motion is fully briefed and ready for disposition.
The background of this case is set out in detail in the Court's January 15, 2015 Order. (Doc. No. 69 at 1-4) Briefly, the parties' dispute arises from a cyber attack and data breach of Schnucks' payment and card processing systems in late 2012 through early 2013. The parties' relationship is governed by a Master Services Agreement ("MSA") between Schnucks and First Data, a Bankcard Addendum to Master Services Agreement ("Bankcard Addendum") between Schnucks, First Data, and Citicorp, and First Data's Program Terms and Conditions ("Operating Procedures") (collectively referred to as "the Agreement"). The Agreement obligates Schnucks to indemnify Defendants for "all losses, liabilities, damages and expenses" under certain circumstances, but also limits Schnucks' liability to $500,000, with two exceptions. For noncompliance with an industry-imposed network security framework known as Payment Card Industry Data Security Standards ("PCI DSS"), the limit is higher ($3,000,000), while for "chargebacks, servicers' fees, third party fees, and fees, fines or penalties" assessed by Visa and MasterCard ("the Associations"), the limit does not apply at all.
Schnucks alleged Defendants breached the Agreement by wrongfully withholding funds owed to Schnucks in an amount that was substantially more than the liability limitation of $500,000. Schnucks also sought a declaration that its obligation to indemnify Defendants for losses incurred by issuing banks was limited to $500,000 under the terms of the parties' Agreement and that Defendants must return to Schnucks the amount of Schnucks' funds placed in a Reserve Account that exceeded the amount of the Visa fine and MasterCard case management fee. Defendants asserted a counterclaim against Schnucks for a declaration that the limitation of liability in the Agreement did not apply to: (i) fees charged by MasterCard or Visa to Defendants including, but not limited to, servicers' fees, third-party fees, fees related to fraud reimbursement and recovery, and/or (ii) fees, fines or penalties charged by Visa or MasterCard for failure to comply with the PCI DSS requirements.
Both sides asserted the contract language was unambiguous. Neither side undertook any discovery and proceeded on cross-motions for judgment on the pleadings. The issue presented by the parties' competing motions was whether the exception for "third party fees" or "fees, fines or penalties" applied to liability for issuer losses. The Court denied Defendants' motion and granted Schnucks' motion, ruling that Schnucks' maximum liability under the terms of the Agreement for issuing bank losses assigned by the Associations for monitoring and/or card replacement and counterfeit fraud losses as a result of the data security breach was $500,000.00, and that Defendants must return to Schnucks any funds held in excess of that amount plus the Visa fine and MasterCard case management fee.
Defendants make three arguments in favor of reconsideration. First, Defendants argue the Court misapplied the standard for ruling on a motion for judgment on the pleadings by failing to accept as true their allegations of Schnucks' negligence and PCI DSS non-compliance and draw all reasonable inferences from the pleadings in their favor. As a result, the Court failed to consider the circumstances in which the $3 million limitation of liability applied. (Doc. No. 85 at 4-6) Second, Defendants assert the Court considered documents outside the pleadings, namely the Association Rules, thereby converting Schnucks' motion into a motion for summary judgment without permitting Defendants to present competing evidence. (
Under Rule 54(b), the Court may amend or reconsider any ruling to correct any "clearly or manifestly erroneous findings of facts or conclusions of law."
Defendants first argue the Court overlooked their explicit allegations concerning Schnucks' negligence in connection with the data breach, as well as allegations within the pleadings concerning Schnucks' PCI DSS noncompliance. According to Defendants, if the Court had applied the proper Rule 12 (c) standard,
Section 25 (Data Security) of the Bankcard Addendum authorizes the Associations to impose "restrictions, fines, or prohibit CUSTOMER [Schnucks] from participating in Association programs if it is determined CUSTOMER is non-compliant with such programs." The $3 million limitation of liability provision applies as a limit to those fines imposed by the Associations for PCI DSS non-compliance. The parties acknowledged that virtually all of the actual and projected assessments ("approximately 97%") imposed by the Associations were for reimbursement of losses claimed by issuing banks.
Because assessments for the purpose of reimbursing issuing banks are not fines for noncompliance with § 25 of the Bankcard Addendum, the $3 million exception would only apply if the remaining 3% was a "fine" or "fee." The general allegation in the affirmative defenses of Schnucks' negligence is conclusory and certainly insufficient to even suggest a fine or fee for PCI DSS noncompliance. Neither side addressed the remainder of the assessments imposed by the Associations in the earlier arguments and pleadings and the Court will not do so at this juncture.
Next, Defendants assert the Court erred in considering and relying on the Association Rules, which they now contend were neither part of the pleadings nor the Agreement. The Court finds no basis for finding it improperly considered the Association Rules in light of the information presented to the Court on the parties' motions for judgment on the pleadings. The parties agreed the MSA, Bankcard Addendum, and Operating Procedures, all attached to the pleadings, constitute the entire agreement between the parties. The Operating Procedures are essentially a summary of common Association Rules paired with a caveat that the merchant should "consult the Card Organization Rules for complete information and to ensure full compliance with them." (Doc. No. 37-3 at 3)
The Bankcard Addendum incorporates the terms of the MSA and First Data's Operating Procedures. Both the MSA and Bankcard Addendum incorporate the rules and regulations of Visa and MasterCard ("the Associations"). The Bankcard Addendum obligates Schnucks to comply with the Association Rules as they may be amended from time to time and states that the respective rights and obligations of Defendants shall be governed by, inter alia, the Bankcard Association Rules. The Bankcard Addendum further states Defendant Citicorp's obligations "shall be limited to the sponsorship and settlement of certain Card transactions submitted in accordance with the terms and conditions of this Bankcard Addendum and the Bankcard Association Rules." (
Clearly this is an argument that Defendants could have asserted in prior briefing. A motion to reconsider under Rule 54(b) cannot be used to identify facts or legal arguments which could have been, but were not, raised in the original motion.
As for the Court's alleged errors in construing the Agreement, Defendants are merely reasserting arguments previously rejected by the Court. Defendants assert the Court did not give effect to the terms "all" or "without limitation" in the definition of "Third Party Fees" and "did not even attempt to ascribe meaning to the term `charges.'" (Doc. No. 85 at 11) The Court considered this argument presented by Defendants in their prior briefing in support of their interpretation of "Third Party Fees" to encompass "issuer reimbursements" (
Defendants also argue the term "fee" was susceptible to more than one meaning, thereby necessitating denial of Schnucks' motion. Defendants could certainly have raised this argument in response to the underlying motion, but failed to do so, and may not now use it to argue for reconsideration.
Lastly, Defendants argue the Court's construction of the Agreement leads to a commercially unreasonable result by effectively making them an insurer of Schnucks for any damage done, regardless of cause, resulting from Schnucks' PCI DSS non-compliance and data breaches." This argument is without merit. The Court is simply giving effect to terms in an agreement between sophisticated parties where each side argues the agreement is unambiguous. Schnucks' obligation to indemnify Defendants for losses incurred by issuing banks up to $500,000 is a commercially reasonable result. Indeed, the Court rejected Defendants' interpretation that the terms "Third Party Fees" and "fees, fines or penalties" apply to liability for issuer losses because it would have resulted in holding Schnucks responsible for all financial liability imposed on Defendants by the Associations relating to the data breach, thereby rendering the limitation of liability clause meaningless. (Doc. No. 69 at 17) Because none of Defendants' arguments for reconsideration are deemed sufficient by the Court, Defendants' motion to reconsider will be denied.
Defendants move in the alternative for leave to amend their pleadings. Although leave to amend "shall be freely given when justice so requires,"
Defendants' motion to amend comes over eight months after the deadline in the Case Management Order. Defendants assert the need to amend was brought to light by the Order's conclusion that Defendants "did not allege that Schnucks was either negligent or PCI DSS non-compliant" or "the proper application of the $3 million limitation of liability provision." Defendants are responsible for pleading their case without the Court's assistance. Defendants do not assert a change in the law or discovery of new facts. Instead, it appears Defendants' proposed amendments could have been asserted within the time allowed for amending the pleadings. Accordingly, the Court finds no good cause has been shown.
Further, district courts in this circuit have considerable discretion to deny a post-judgment motion for leave to amend because such motions are disfavored.
After careful review of the parties' legal memoranda and the applicable law, the Court concludes that Defendants have failed to establish a basis for finding any "clearly or manifestly erroneous findings of facts or conclusions of law."
Accordingly,