The National Law Forum

CPSC & DOJ Sue Michaels Stores for Failing to Report Product Safety Hazard and Filing Misleading Information

For the first time in recent memory, the Department of Justice (DOJ) and Consumer Product Safety Commission (CPSC) jointly announced the filing of a lawsuit in federal court for the imposition of a civil penalty and injunctive relief for violation of the Consumer Product Safety Act (CPSA). The lawsuit is against arts and crafts retailer Michaels Stores and its subsidiary Michaels Stores Procurement Co. Inc. (collectively, “Michaels” or “the Company”) for failing to timely report a potential product safety hazard to the CPSC. Unlike other CPSC civil penalty actions involving DOJ, this penalty does not already have a negotiated consent decree in place and it appears that the case could be fully litigated.

The complaint alleges that Michaels knowingly violated the CPSA by failing to timely report to the CPSC that the glass walls of certain vases were too thin to withstand normal handling, thereby posing a laceration hazard to consumers. According to the complaint, multiple consumers suffered injuries, including nerve damage and hand surgeries, from 2007 to late 2009.

Michaels allegedly did not report the potential defect to the Commission until February 2010. Of course, we only know one side of the allegations, and Michaels will respond to those allegations in the coming weeks. The Company did state that “it believes the facts will show it acted promptly and appropriately.”

Water Notably, the complaint also alleges that when Michaels filed an initial report with the CPSC in 2010, it provided “only the limited information required to be furnished by distributors and retailers” under the CPSA. However, and critically, as the complaint sets forth in more detail, manufacturers—whose definition under the CPSA includes importers of record—are required to provide more information to the Commission than retailers.

According to the government, Michaels’ report conveyed the false impression that the Company did not import the vases, even though the Company was the importer of record and thus was required to submit significantly more information as themanufacturer of the vases. The lawsuit alleges that Michaels made this misrepresentation in order to avoid the responsibility of undertaking a product recall.

As for the remedy, the government is seeking a civil penalty (in an unidentified amount) and various forms of injunctive relief, including the enactment of a stringent compliance program to ensure future compliance with CPSC reporting obligations. This requested relief is similar to what the CPSC has required in almost all civil penalty agreements with other companies over the past few years.

What makes this complaint so newsworthy is that the government and Michaels plan to litigate the imposition of a civil penalty. As noted above, this is not a frequent occurrence because companies tend to settle civil penalty claims rather than litigate. Given how infrequently civil penalties are litigated and the lack of any legal precedent guiding civil penalty negotiations under the heightened $15 million penalty limits, any judgment likely would have a wide-ranging impact on all future civil penalty negotiations between companies and the CPSC.

As we have previously stated, we expect the Commission to remain active in 2015 in bringing enforcement actions against companies for violations of the CPSA and other safety statutes.

We will watch this case closely and update our readers on any noteworthy developments.

ARTICLE BY

Matthew Cohen

Matthew R. Howsare

Charles A. Samuels

Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.

Consumer Product Matters Blog

CPSC & DOJ Sue Michaels Stores for Failing to Report Product Safety Hazard and Filing Misleading Information

As we have previously stated, we expect the Commission to remain active in 2015 in bringing enforcement actions against companies for violations of the CPSA and other safety statutes.

We will watch this case closely and update our readers on any noteworthy developments.

ARTICLE BY

Matthew Cohen

Matthew R. Howsare

Charles A. Samuels

Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.

Consumer Product Matters Blog

DOE Highlights the Need to Modernize Aging US Energy Infrastructure

The first installment of the Obama Administration’s comprehensive survey and analysis of the US energy sector provides a detailed roadmap for modernizing the energy transmission, storage, and distribution system to make it more secure and resilient to the effects of climate change while taking advantage of recent advances in energy and information technologies.

On April 21, the Obama Administration released the first comprehensive survey and analysis of the United States’ basic energy infrastructure needs for the 21st century. The Quadrennial Energy Review (QER), announced by Vice President Joe Biden and Secretary of the Department of Energy (DOE) Ernie Moniz, provides a critical analysis of vulnerabilities in the energy transmission, storage, and distribution systems in the United States. The report also includes policy recommendations to modernize these systems and to make them more secure and resilient to the effects of climate change and more flexible in response to recent advances in energy and information technologies.

The first QER report includes several specific recommendations for investments in energy infrastructure upgrades and new policies designed to promote responsible development of domestic energy sources and to facilitate more timely environmental review and permitting decisions. Priorities outlined in the report will likely shape legislative and administrative actions that could affect markets and shape commercial opportunities in the energy sector. Key recommendations include the following:

Reducing siting and permitting times for energy infrastructure projects

Updating existing energy infrastructure, especially natural gas pipelines, to improve safety and enhance the delivery of abundant domestic supplies of natural gas

Modernizing and standardizing the electric grid

Enhancing the nation’s ability to respond to energy supply emergencies

Background

On January 9, 2014, President Barack Obama directed an interagency Task Force, which included members from all relevant executive departments and agencies, to submit a QER report every four years beginning in 2015.[2] The reports are intended to undertake a rigorous review of existing federal energy infrastructure and policy and to provide an integrated set of recommendations on how best to transform US energy production, delivery, and consumption systems at the local, state, and federal levels. The QER is a key component of the Obama Administration’s Climate Action Plan and is designed to ensure that new federal energy policy meets the nation’s economic, environmental, and energy security goals by providing an “analytically based, clearly articulated, sequenced and integrated actions, and proposed investments over a four-year planning horizon.”[3]

This first installment of the QER recognizes that the US energy landscape is undergoing an unprecedented transformation in the way that we generate, deliver, use, and even think about energy. These fundamental changes present challenges and opportunities to public- and private-sector stakeholders that are addressing, for example, the technical challenges associated with the influx of large quantities of variable energy resources; heightened safety concerns; the political challenges associated with competing energy, environmental, and economic policy goals; and the regulatory challenges posed by the complex, multilayered network of permitting authorities and regulations that govern the US energy system. To accommodate the interests of those most affected by these challenges, the DOE hosted 13 stakeholder engagement meetings across the country to gather public input for the QER.

Opportunities and Challenges

The first QER report focuses on US infrastructure for transmission, storage, and distribution (TS&D) of energy, because these basic components of the energy delivery system will shape supply and end-use patterns and practices for decades. Further, the federal government has recognized that once built, this infrastructure is relatively inflexible, and thus getting it right from the outset will determine whether the government can collectively meet the nation’s energy, national security, and climate change objectives.

The QER report outlines a multiyear roadmap to guide federal actions at the legislative, executive, and administrative levels that relate to energy infrastructure investments, siting and permitting, electricity market integration, workforce development, and heightened grid security.

Improvements to TS&D Infrastructure Siting and Permitting

Although it is important to consider the changing energy mix and how best to integrate new technologies onto the electric grid, for example, this cannot be achieved without improving interagency coordination and transparency for project planning and siting—an issue addressed in the final chapter of the QER report. The cost, time, and complexity of siting and permitting large infrastructure in the federal system will be a serious hurdle to implementing the QER’s infrastructure recommendations. Currently, there are “more than 35 distinct permitting and review responsibilities across more than 18 Federal agencies and bureaus, implemented by staff at headquarters and hundreds of regional and field offices.” To make this system less onerous for developers, the Obama Administration has committed to reducing permitting timelines for major infrastructure projects by half while also improving outcomes for communities and the environment. But, as the QER recognizes, it is still an open question whether, absent additional legislative authority and congressionally appropriated funding, these reforms can be accomplished.

To that end, the QER adopts five key recommendations to assist with the siting, permitting, and review of infrastructure projects: (1) allocate resources to key federal agencies; (2) prioritize meaningful public engagement through consultation with American Indian tribes, coordination with state and local governments, and facilitation of nonfederal partnerships; (3) expand landscape- and watershed-level mitigation and conservation planning; (4) enact statutory authorities to improve coordination across agencies; and (5) adopt Administration proposals to authorize the recovery of costs for review of project applications.

Even if all these recommendations are followed, however, meaningful change may remain elusive unless the Administration sustains cabinet-level leadership and support for such reforms. Further, most of the decisions necessary to permit infrastructure projects are made by state or local agencies or in local field or state offices of federal agencies. To obtain truly transformative changes in energy infrastructure siting and permitting, the key agency staff at the state, local, and regional levels must be personally invested and dedicated to the Administration’s priorities.

Additional QER Recommendations

Other QER chapters identify important opportunities to modernize, expand, replace, or transform the TS&D system so that it better accommodates changes in energy supply, integrates forward-looking information and security technologies, and meets increasing demand for new consumer services. This includes recommendations for smart grid technology and distributed generation, as well as modernization of the strategic petroleum reserve and the safety challenges of methane gas. Key recommendations include the following:

Increase the resilience, reliability, safety, and asset security of the TS&D infrastructure by establishing DOE programs to accelerate natural gas pipeline replacement and maintenance and to provide competitively awarded grants to states that demonstrate innovative approaches to TS&D infrastructure enhancements, with a particular focus on resilience and reliability improvements.

Modernize the electric gridby spearheading DOE coordination with the standards organizations, other federal agencies, industry, state officials, and others to establish standards that enhance connectivity and interoperability on the electric grid.

Address environmental aspects of the TS&D infrastructure by commencing a coordinated effort between the DOE and the Environmental Protection Agency to improve quantification of emissions from natural gas TS&D infrastructure.

Next Steps

Building on the foundation laid by the Blueprint for a Secure Energy Future and the Climate Action Plan, the QER represents another step in the Administration’s efforts to leverage US domestic energy resources while strengthening energy security, reliability, and climate resiliency. Although the QER is only advisory, it recommends several specific legislative actions that would change the landscape for future and ongoing energy sector development, including funding the Interagency Infrastructure Permitting Improvement Center, a pilot version of which is currently housed in the Department of Transportation; restore appropriations to the various federal agencies responsible for infrastructure siting, review, and permitting; and update Strategic Petroleum Reserve (SPR) release authorities to allow the SPR to be used more effectively to prevent serious economic harm to the United States in case of energy supply emergencies. The QER report may also reignite stalled congressional efforts to accelerate natural gas pipeline repair to prevent explosions and accidents, decrease costs to consumers, and reduce methane leaks that contribute substantially to the US “carbon footprint.”

If nothing else, the QER report serves as a stark reminder of how much work there is to do to create the energy infrastructure necessary to support the modern economy, and of the many opportunities for innovative companies to contribute to that process. In light of the complex landscape and shifting federal priorities regarding TS&D infrastructure development, siting and security, companies doing business in this sector will benefit from counsel with the breadth and depth of experience necessary to develop a successful strategy and the acumen and relationships to execute it.

ARTICLE BY

Steve W. Black

Sarah M. Keane

Kelly M. Gorton

Morgan, Lewis & Bockius LLP

Junk Fax Act Compliance: One Week Left to Request a Waiver for Non-Compliance

Thursday, April 30, 2015, marks the last day a business can request a retroactive waiver for failing to comply with certain fax advertising requirements promulgated by theFederal Communications Commission (FCC). The scope of these requirements was clarified on October 30, 2014, when the FCC issued an Order (2014 Order) under the Junk Fax Prevention Act of 2005 (Junk Fax Act). The 2014 Order confirms that senders of all advertising faxes must include information that allows recipients to opt out of receiving future faxes from that sender.

The 2014 Order clarifies certain aspects of the FCC’s 2006 Order under the Junk Fax Act (the Junk Fax Order). Among other requirements, the Junk Fax Order established the requirement that the sender of an advertising fax provide notice and contact information that allows a recipient to “opt out” of any future fax advertising transmissions.

Following the FCC’s publication of the Junk Fax Order, some businesses interpreted the opt-out requirements as not applying to advertising faxes sent with the recipient’s prior express permission (based on footnote 154 in the Junk Fax Order). The 2014 Order provided a six-month period for senders to comply with the opt-out requirements of the Junk Fax Order for faxes sent with the recipient’s prior express permission and to request retroactive relief for failing to comply. The six-month period ends on April 30, 2015. Without a waiver, the FCC noted that “any past or future failure to comply could subject entities to enforcement sanctions, including potential fines and forfeitures, and to private litigation.”

ARTICLE BY

Julia Jacobson

Matthew R. Turnell

McDermott Will & Emery

Australian Federal Government Implements Changes to 457 Visa

Following the publication of the independent review into the Temporary Skilled (Subclass 457) visa program, the federal government announced on 18 March 2015 its intention to implement a number of the proposed changes to ‘increase flexibility and reduce restrictions on 457 programme users while maintaining integrity in the programme’.

Despite growing suspicions that this would be another ‘broken promise’, the government has now implemented the following changes from 18 April 2015.

English language

An applicant can now satisfy the English language requirement by obtaining an average score of five across all components of the International English Language Testing System (IELTS), rather than a score of five in each component (reading, writing, speaking and listening). The number of English language tests has also been increased to include the following in addition to IELTS:

Occupational English Test (OET)
Test of English as a Foreign Language internet-based test (TOEFL iBT)
Pearson Test of English (PTE) Academic test
Cambridge English: Advanced (CAE) test

Exemptions to the English language requirement will also be granted when an applicant can provide evidence of five cumulative (rather than consecutive) years of study in English at the secondary or tertiary level.

Standard Business Sponsorship term

The term of a standard business sponsorship has been extended from 3 years to 5 years.

Start-up businesses will also benefit from an increase in the term of their standard business sponsorship from 12 months to 18 months, giving start-up businesses a greater grace period to establish lawful operations in Australia. 457 visas granted to employees of start-up businesses will also now be granted for 18 rather than 12 months.

Market salary exemption threshold

Employers will no longer be required to demonstrate that highly paid 457 applicants will be paid in line with the Australian market in cases where the visa holder will be paid in excess of $180,000 (down from the existing threshold of $250,000). This brings the threshold in line with the marginal tax rate. The Temporary Skilled Migration Income Threshold (TSMIT) has also been frozen at $53,900.

MARN 1460940

ARTICLE BY

Jillian R. Howard

Adriana Bedon

Squire Patton Boggs (US) LLP

Employment Law Worldview

FDA Regulation of mHealth Updates

At the Food Drug and Law Institute’s annual conference on April 21, 2015, Bakul Patel, Associate Director for Digital Health, Office of Center Director, Center for Devices and Radiological Health (CDRH), held a discussion of “FDA Regulation of Mobile Health/Medical Applications.” There have already been several important developments in FDA regulation of mHealth products this year. Patel stated that FDA recognizes the importance of digital health, and its potential to drive be

ARTICLE BY

Cassie Scherer

Covington & Burling LLP

Covington E-Health

tter health outcomes and promote patient engagement. Patel discussed two recently released draft guidances that impact FDA regulation of mHealth, the draft General Wellness Guidance and the draft Accessories Guidance, and highlighted that FDA continues to work promote innovation while at the same time protecting patient safety. The public comment period for these guidances ended on April 20th, and Patel noted that CDRH did not receive many comments. Finally, Patel emphasized that industry can continue to reach out to FDA with questions about mobile health at mobilemedicalapps@fda.hhs.gov or digital health at digitalhealth@fda.hhs.gov.

The discussion draft of the 21st Century Cures Act includes sections that would exclude “health software” from regulation as a medical device, and would require FDA to promulgate regulations to establish standards and procedures for regulating “medical software.” New 21st Century Cures language may be released by the end of this month. We will be watching closely to see if there are any changes to the software language.

Amicus Briefs On Biosimilar Patent Litigation

Foley and Lardner LLP

Amgen has appealed the district court decision denying its motion for a preliminary injunction to keep Sandoz’ biosimilar version of Neupogen® off the market. The appeal is on an expedited briefing schedule at the Federal Circuit, and three amicus briefs have been filed. All of the amicus briefs argue for reversal of at least some of the district court’s decision regarding the biosimilar patent litigation framework of the BPCIA.

The Biotechnology Industry Organization

The Biotechnology Industry Organization filed an amicus brief arguing that the BPCIA should be interpreted as requiring “notice to the reference product sponsor of the initial submission of the biosimilar application” and “notice of potential commercial marketing upon approval.” BIO argues that these procedures must be mandatory in order for the patent dispute resolution provisions of the law to achieve their purpose of “provid[ing] a significant and real opportunity to resolve patent issues prior to the launch of the biosimilar.”

Abbvie Inc.

AbbVie Inc. filed an amicus brief arguing that “the notice-and-exchange provisions are mandatory” and that a biosimilar applicant’s “failure to comply with the statute is unlawful.” According to AbbVie, if the district court decision is upheld “the entire biosimilar litigation process would become a free-for-all, where biosimilar companies would utilize the data and work of innovator companies but refuse to provide basic information about their products … leaving innovators to blindly guess as to which patents they should sue on and when.”

AbbVie also argues that the BPCIA does not preempt Amgen’s state law claims of unfair competition.

Janssen Biotech, Inc.

Janssen Biotech, Inc. filed an amicus brief asking the Federal Circuit to “clarify that the statutory patent dispute resolution procedures are intended to be followed as written, and are not merely optional choices or empty formalities.” Janssen criticizes the district court decision for “transforming [the BPCIA’s patent provisions] from a carefully orchestrated dispute resolution process into a series of strategic options existing for the sole benefit of the biosimilar applicant.”

Janssen also urges the Federal Circuit to decide that the notice of commercial marketing required by the BPCIA may not be provided before a biosimilar product is licensed by the FDA. One argument Janssen makes on this point is that the notice of commercial marketing gives the reference product sponsor the right to seek a preliminary injunction based on alleged patent infringement, but a preliminary injunction cannot be granted unless commercial launch is imminent, and commercial launch is not possible until the biosimilar has been licensed by the FDA.

The Expedited Appeal Schedule

Amgen filed its opening brief on April 3. Sandoz filed its brief on April 21. Oral arguments are scheduled for June 3.

ARTICLE BY

Courtenay C. Brinckerhoff

Foley & Lardner LLP

Telecoms File Lawsuit Challenging Net Neutrality Rules

The Federal Register officially published the FCC’s new rules governing net neutrality on Monday, April 13, 2015, and the new rules will take effect 60 days following the date of publication. As anticipated, AT&T and the wireless and cable industry groups immediately filed suit in the D.C. Circuit Court to challenge the new rules on Tuesday, April 14, 2015. The litigation is spearheaded by AT&T and its trade group CTIA – The Wireless Association which also represents Verizon, Sprint and T-Mobile. The suit represents a new stage in the telecommunications industry’s efforts to challenge the recently enacted rules. Read additional coverage of the suit including potential arguments the telecommunications groups will raise, and stay tuned for our take on the developing litigation.

ARTICLE BY

Allen Matkins Leck Gamble Mallory & Natsis LLP

California Wireless Law Blog

Will Cyberinsurance Cover Target’s $19 Million Mastercard Settlement?

Another credit card in the mail?

If you’re reading this post, you’ve probably received a new credit or debit card in the mail, attached by rubber cement to a cover letter explaining that your card number could have been compromised – so you ended up with replacement cards. You might even have received new cards more than once over the past five years. Perhaps you even received a new card with an explanation that after the data breach at Target Corporation, your “issuing bank” – the bank that issued you the credit or debit card – decided to send you a new card. And maybe you signed your card, called to activate it, replaced your old card, and didn’t give a second thought to it. After all, consumers generally are not financially responsible for fraudulent charges and likely did not pay to get the shiny new piece of plastic in the mail.

What are card brand liabilities?

The payment card brands, however, view such incidents differently than do individual consumers. The payment card brands frequently pursue retailers, either directly or by means of a payment processor. They allegedly do so on behalf of the issuing banks and the losses that the issuing banks allegedly suffered as a result of the data breach.^[1]The brands allege that the retailers are responsible for the fraudulent charges that were incurred and the amounts spent to replace payment cards. As Target explained in its 2014 Form 10-K:

“In the event of a data breach where payment card data is or may have been stolen, the payment card networks’ contracts purport to give them the ability to make claims for reimbursement of incremental counterfeit fraud losses and non-ordinary course operating expenses (such as card reissuance costs) that the payment card networks believe they or their issuing banks have incurred as a result of the event.”^[2]

Those amounts can run into the millions of dollars (Card Brand Liabilities). Card Brand Liabilities also may include amounts for alleged failures to maintain certain levels of computer security required by contract (so-called PCI-DSS compliance).^[1]The amounts owed for alleged fraudulent charges and replacement of compromised credit cards often dwarfs the amounts of fines for alleged PCI non-compliance.^[2]Some incidents that involved more than 1 million allegedly exposed card numbers have resulted in Card Brand Liabilities in the millions of dollars.^[3]

Target’s card brand liabilities…and pending settlement of them with MasterCard

Target disclosed that three out of the four payment card brands made written demands for Card Brand Liabilities, and that it expected the fourth brand to do so as well.^[4] The total amount of Target’s potential Card Brand Liabilities is unclear, but Target did disclose that it had incurred $252 million of data breach-related expenses, an amount that accounts for Card Brand Liabilities.^[5]

On April 15, 2015, Target announced that it had reached a settlement of its Card Brand Liabilities with MasterCard for up to $19 million.^[6] Interestingly, Target explained that the settlement is contingent upon the issuing banks, which allegedly reimbursed the fraudulent charges and issued the new cards, agreeing to accept payment via the MasterCard settlement and the issuing banks dropping claims against Target.^[7] This requirement is fascinating, as issuing banks have filed a putative class action against Target directly, alleging that they suffered losses as a result of Target’s data breach.^[8] It may be that the MasterCard settlement resolves at least part of the claims at issue in the issuing bank litigation.

Will Target’s cyberinsurance cover its card brand liability settlement?

Now for the question you’ve been waiting for: will Target’s insurance policies cover its $19 million settlement with MasterCard? Probably.

Without commenting on the correctness of the position, consider that one underwriter has written that Card Brand Liabilities are contract-based indemnities and may be excluded from cyberinsurance coverage, with emphasis added:^[9]

Many policy forms in the marketplace directly exclude contractual indemnities and liability, including that which stems from merchant service agreements. Some policy forms initially grant coverage for breach of contract claims, but then add exclusions concerning key components of this coverage. In addition, some policy forms exclude breach of contract claims with some very narrow carvebacks to the exclusionary wording that may not help the insured much in the event of a payment card breach.

Although most privacy/security insurance policies grant the insured coverage for situations in which they need to incur the first-party costs to notify individuals and extend insureds credit monitoring services, not all will directly respond to the breach of, or the indemnities contained in, a merchant services agreement.

Without commenting on the merits of it, consider an opposing view that Card Brand Liabilities could be treated as common law claims for purposes of insurance coverage, not liabilities created by contract, and the payment card brands are demanding amounts as agents for the issuing banks. Target may not have to address whether its Card Brand Liabilities were created by merchant services agreement contracts or are common law liabilities, because Target reportedly has $50 million in coverage for this exact type of loss:

“To limit our exposure to losses relating to data breach and other claims, we maintain $100 million of network-security insurance coverage, above a $10 million deductible and with a $50 million sublimit for settlements with the payment card networks.”^[10]

How would your insurance cover card brand liabilities? Even if you have cyberinsurance, does the policy address card brand liabilities? Does your insurance carrier’s claim handler view the losses as liabilities under a merchant services agreement contract? Or as common law liabilities? If it’s the former, are there exclusions for liabilities allegedly assumed in a merchant services agreement contract? Or sublimits on the total policy limit (making just a fraction of coverage available)?

Consider using the Target announcement as a perfect opportunity to review your insurance – including your cyberinsurance – policies closely to figure out whether you would have full coverage for these losses. The last thing that you want to face is the prospect of your insurer denying coverage for millions of dollars in losses after you were told that buying cyberinsurance would be a panacea for all things cyberrisk.

_{[1] See, e.g., First Bank of Del., Inc. v. Fid. & Deposit Co. of Md., 2013 WL 5858794, at *2 (Del. Super. Oct. 30, 2013), rearg. denied, 2013 WL 6407603 (Del. Super. Dec. 4, 2013).}

_{[2] Genesco, Inc. v. Visa U.S.A., Inc., 296 F.R.D. 559, 564 (M.D. Tenn. 2014) (over $13 million in liabilities overall, but only $10,000 in “fines for failing to ensure Genesco’s PCI DSS compliance”), opinion amended and superceded on other grounds, 2014 WL 935329 (M.D. Tenn. Mar. 10, 2014).}

_{[3] See, e.g., Retail Ventures, Inc. v. Nat’l Union Fire Ins. Co. of Pittsburgh, PA, 691 F.3d 821, 824-25 (6th Cir. 2012) (retailer suffered more than $4 million in Card Brand Liabilities after credit card-based data incident); First Bank of Del., 2013 WL 5858794, at *2 (bank and debit card processor paid $1.4 million in compensatory damages due to Card Brand Liabilities after data incident of retailer with whom company did business); Genesco, Inc. v. Visa U.S.A., Inc., 296 F.R.D. 559, 564 (M.D. Tenn. Jan. 14, 2014) ($13.3 million in Card Brand Liabilities after a credit card-based data incident).}

_{[4] Target, Form 10-K, Target Corporation SEC Filings (Mar. 14, 2014), available here.}

_{[5] Target, Form 10-K, Target Corporation SEC Filings (Mar. 14, 2014), available here.}

_{[6] Target, Target Announces Settlement Agreement with MasterCard; Estimated Costs Already Reflected in Previously Reported Results (Apr. 15, 2015), available here.}

_[7] Id.

_{[8] See In re Target Corp. Customer Data Security Breach Litigation (Financial Institution Cases), MDL No. 14-2522 (PAM/JJK), slip op. (D. Minn. Dec. 2, 2014). A copy of the decision is available via Google Scholar.}

_{[9] Matt Donovan, Banking on Credit: Merchants bear the brunt of data breach risks in the hospitality industry, PropertyCasualty 360º (Dec. 1, 2013), available at http://www.propertycasualty360.com/2013/12/01/banking-on-credit?t=commercial (emphasis added).}

_{[10] Target, , Form 10-Q, Target Corporation SEC Filings (Nov. 26, 2014), available here.}

_{[1] MasterCard’s Security Rules and Procedures could be read to suggest that MasterCard is acting as an agent for issuing banks and demands against retailers are made on behalf of the issuing banks in whole or in part. MasterCard, Security Rules and Procedures – Merchant Edition, § 10.2.5.3 (Feb. 5, 2015) available at http://www.mastercard.com/us/merchant/pdf/SPME-Entire_Manual_public.pdf.}

_{[2]Target, Form 10-K, Target Corporation SEC Filings (Mar. 14, 2014), available here.}

ARTICLE BY

Scott N. Godes

Barnes & Thornburg LLP

Will Cyberinsurance Cover Target's $19 Million Mastercard Settlement?

Another credit card in the mail?

What are card brand liabilities?

“In the event of a data breach where payment card data is or may have been stolen, the payment card networks’ contracts purport to give them the ability to make claims for reimbursement of incremental counterfeit fraud losses and non-ordinary course operating expenses (such as card reissuance costs) that the payment card networks believe they or their issuing banks have incurred as a result of the event.”^[2]

Target’s card brand liabilities…and pending settlement of them with MasterCard

Will Target’s cyberinsurance cover its card brand liability settlement?

Now for the question you’ve been waiting for: will Target’s insurance policies cover its $19 million settlement with MasterCard? Probably.

Many policy forms in the marketplace directly exclude contractual indemnities and liability, including that which stems from merchant service agreements. Some policy forms initially grant coverage for breach of contract claims, but then add exclusions concerning key components of this coverage. In addition, some policy forms exclude breach of contract claims with some very narrow carvebacks to the exclusionary wording that may not help the insured much in the event of a payment card breach.

Although most privacy/security insurance policies grant the insured coverage for situations in which they need to incur the first-party costs to notify individuals and extend insureds credit monitoring services, not all will directly respond to the breach of, or the indemnities contained in, a merchant services agreement.

“To limit our exposure to losses relating to data breach and other claims, we maintain $100 million of network-security insurance coverage, above a $10 million deductible and with a $50 million sublimit for settlements with the payment card networks.”^[10]

_{[1] See, e.g., First Bank of Del., Inc. v. Fid. & Deposit Co. of Md., 2013 WL 5858794, at *2 (Del. Super. Oct. 30, 2013), rearg. denied, 2013 WL 6407603 (Del. Super. Dec. 4, 2013).}

_{[4] Target, Form 10-K, Target Corporation SEC Filings (Mar. 14, 2014), available here.}

_{[5] Target, Form 10-K, Target Corporation SEC Filings (Mar. 14, 2014), available here.}

_{[6] Target, Target Announces Settlement Agreement with MasterCard; Estimated Costs Already Reflected in Previously Reported Results (Apr. 15, 2015), available here.}

_[7] Id.

_{[10] Target, , Form 10-Q, Target Corporation SEC Filings (Nov. 26, 2014), available here.}

_{[2]Target, Form 10-K, Target Corporation SEC Filings (Mar. 14, 2014), available here.}

ARTICLE BY

Scott N. Godes

Barnes & Thornburg LLP

The National Law Forum

CPSC & DOJ Sue Michaels Stores for Failing to Report Product Safety Hazard and Filing Misleading Information

Like this:

CPSC & DOJ Sue Michaels Stores for Failing to Report Product Safety Hazard and Filing Misleading Information

Like this:

DOE Highlights the Need to Modernize Aging US Energy Infrastructure

Background

Opportunities and Challenges

Improvements to TS&D Infrastructure Siting and Permitting

Additional QER Recommendations

Next Steps

Like this:

Junk Fax Act Compliance: One Week Left to Request a Waiver for Non-Compliance

Like this:

Australian Federal Government Implements Changes to 457 Visa

English language

Standard Business Sponsorship term

Market salary exemption threshold

Like this:

FDA Regulation of mHealth Updates

Like this:

Amicus Briefs On Biosimilar Patent Litigation

The Biotechnology Industry Organization

Abbvie Inc.

Janssen Biotech, Inc.

The Expedited Appeal Schedule

Like this:

Telecoms File Lawsuit Challenging Net Neutrality Rules

Like this:

Will Cyberinsurance Cover Target’s $19 Million Mastercard Settlement?

Another credit card in the mail?

Target’s card brand liabilities…and pending settlement of them with MasterCard

Like this:

Will Cyberinsurance Cover Target's $19 Million Mastercard Settlement?

Another credit card in the mail?

Target’s card brand liabilities…and pending settlement of them with MasterCard

Like this: