Target Seeks to Exclude Banks from Data Breach Class Action Lawsuit

UPDATE: A federal judge has preliminarily approved a $10 million class action settlement. Details on how to file a claim for the Target data breach settlement can be found here.

UPDATE 2: The Target data breach class action settlement received final approval on Nov. 17, 2015.

On Wednesday, Target Corp. filed a supporting reply brief in Minnesota federal court, reiterating its argument that banks should not be a part of the data breach class action lawsuit stemming from the large theft of consumer credit card information last winter.

Earlier this month, Target filed a motion to dismiss the class action lawsuit alleging that Target was negligent in providing inadequate security measures to protect customers’ credit card information and should also pay banks for the costs of replacing credit card and account information that were compromised by the breach.

In its supporting brief, Target argues that merchants aren’t liable to issuers following data breaches. Under Minnesota’s data protection law, Target contends, plaintiffs must establish a “special relationship” in order to pursue allegations that one party failed to protect another from a third party.

“The banks do not — and cannot — argue that the merchant/issuer relationship is among those recognized as ‘special’ under Minnesota law, and each of their theories for why they have nonetheless alleged a special relationship is contradicted by Minnesota law,” Target wrote in its motion.

Target contends that it conformed to data protection standards used throughout the industry, known as the Payment Card Industry Data Security Standards (PCI-DSS), and that the banks and credit unions already admitted that in their data breach class action lawsuit.

“The mere fact of a sophisticated criminal intrusion does not imply negligence,” Target argues. “As to the gravamen of the banks’ claim — that Target ‘failed to adhere to applicable industry [security] standards’ … the banks admit Target was certified as compliant with ‘all “payment industry requirements,” including the [PCI-DSS],’ and offer no rejoinder to Target’s argument that the banks have not adequately pled any PCI-DSS violation.”

The Target data breach class action lawsuit stems from last winter’s massive data breach that affected as many as 110 million Target customers whose personal or financial information was compromised and, as a result, making it one of the largest data breaches in U.S. history. Target is one of the largest retailers in the United States, with nearly 2,000 locations in the United States and Canada.

In August, banks and credit unions filed an amended class action lawsuit against Target to recover the costs of replacing account information and credit cards for people affected by the breach. The Target data breach class action lawsuit was consolidated into multidistrict litigation in Minnesota in April and, currently, the case is set for trial in 2016.

The consumer plaintiffs are represented by Stueve Siegel Hanson LLP, Milberg LLP,Girard Gibbs LLP, Nichols Kaster PLLP and Heins Mills & Olson PLC.

The financial institutions are represented by Zimmerman Reed PLLP, Lockridge Grindal Nauen PLLP, Chestnut Cambronne PA, Reinhardt Wendorf & Blanchfield, Barrett Law Group PA and others.

The Target Data Breach Class Action Lawsuit is In re: Target Corp. Customer Data Security Breach Litigation, Case No. 0:14-md-02522, in the U.S. District Court for the District of Minnesota.