Sovereign Bank v. BJ’s Wholesale Club, Inc.

Sovereign and PSECU are members of the Visa network and have an agreement to issue Visa cards to their customers. BJ’s is a merchant that accepts Visa cards for payment. Fifth Third is also a member of the Visa network acting as an “Acquirer” that processes transactions for its customers, like BJ’s. Fifth Third and Visa had a Member Agreement that included by references its Operating Regulations. The Operating Regulations imposed extensive security and compliance requirements. As part of its Member Agreement, Fifth Third agreed that its merchants would abide by the Operating Regulations. In February 2004, electronically stored Cardholder Information was compromised after Visa cardholders used their cards at BJ’s stores.

Following Fifth Third’s motion for summary judgment, the parties performed discovery during which Visa’s representative, Alex Miller was deposed. Miller testified that the core purpose of the Operating Regulations was to benefit the Visa system and its members. Additionally, an August 1993 Visa memorandum entitled “Retention of Magnetic-Stripe Data Prohibited” was discovered that stated “[a]cquirers are obligated to ensure that their merchants do not store the magnetic-stripe information from Visa Cards . . .” A May 2003 online Visa article entitled “Issuers and Acquirers Are At Risk When Magnetic-Stripe Data Is Stored” was also found during discovery.