Greenstate Credit Union v. Hy-Vee, Inc.
ORDER granting 64 Motion to Dismiss. (Written Opinion) Signed by Judge David S. Doty on 7/19/2021. (DLO)
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 1 of 18
UNITED STATES DISTRICT COURT
DISTRICT OF MINNESOTA
CIVIL NO. 20-621(DSD/DTS)
Greenstate Credit Union
on Behalf of Itself and
All Others Similarly Situated,
Kate M. Baxter-Kauf, Esq. and Lockridge Grindal Nauen PLLP,
100 Washington Avenue South, Suite 2200, Minneapolis, MN
55401, counsel for plaintiff.
Paul G. Karlsgodt, Esq. and Baker & Hostetler LLP, 1801
California Street, Suite 4400, Denver, CO 80202, counsel for
The matter is before the court upon defendant Hy-Vee, Inc.’s
motion to dismiss.
Based on a review of the file, record, and
proceedings herein, and for the following reasons, the court grants
This class action dispute arises out of Hy-Vee’s handling of
a data breach that exposed consumers’ credit card data.
GreenState Federal Credit Union is a federally chartered credit
union with its principal place of business in Iowa.
Compl. ¶ 7.
Hy-Vee is incorporated in Iowa and has its principal place of
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 2 of 18
business in Iowa.
Id. ¶ 12.
Hy-Vee operates supermarkets,
convenience stores, and gas stations, with 240 retail stores in
eight states, including Minnesota.
Id. ¶ 13.
GreenState has twenty-six branch locations, all located in
Courtney Decl. ¶ 2; ECF No. 55, at 3.
is open to: (1) individuals living and working in Iowa, as well as
some counties in Illinois or Wisconsin that border Iowa; (2)
University of Iowa students, staff, and alumni; and (3) direct
relatives of current members.
Id. ¶¶ 3-5; ECF No. 55, at 3.
of approximately 210,000 members - about one-half of one percent
- have Minnesota addresses.
Id. ¶ 7; ECF No. 55, at 3.
Thirty-eight of Hy-Vee’s 264 stores are in Minnesota. Tingley
Decl. ¶¶ 1, 3; ECF No. 55, at 3.
12.38% of Hy-Vee’s revenue comes
from Minnesota, and 13.77% of Hy-Vee’s employees work in Minnesota.
Id. ¶ 3;
ECF No. 55, at 4.
Hy-Vee’s information technology
department, chief technology officer, and information security
team operate in Iowa.
Id. ¶¶ 7-8;
ECF No. 55, at 4.
responsible for decisions regarding Hy-Vee’s data and information
security policy and practices, all of which are made in Iowa.
¶¶ 6-10; ECF No. 55, at 4.
In payment card transactions, there are four primary parties:
the merchant, the acquiring bank, the card network, and the card
Compl. ¶¶ 19-20.
In this context, Hy-Vee is a merchant
that requests authorization of the transaction from the card’s
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 3 of 18
An acquiring bank contracts with the merchant to
process the transaction.
Id. ¶ 19.
Card networks, such as Visa
or MasterCard, are payment processors.
An acquiring bank
receives purchase receipts from the merchant, pays the merchant,
GreenState is a card issuer, which issues payment cards to its
member’s payment card account.
Id. ¶¶ 19-20.
From November 2018 to August 2019, computer hackers installed
malicious software (malware) on Hy-Vee’s point-of-sale systems.
customers’ card data, which included the cardholder’s name, card
number, and expiration date.
Id. ¶ 1.
GreenState alleges that
its members used their payment cards to make purchases at Hy-Vee
locations in Minnesota, and “at least one payment card issued by
[GreenState] was compromised ... after being used by a member at
a Hy-Vee location in Minnesota.”
Id. ¶ 16.
GreenState alleges that Hy-Vee failed to implement adequate
data security measures to protect against data breaches, and failed
to timely discover and contain the breach. Id. ¶¶ 3-4. GreenState
specifically asserts that Hy-Vee “refused to implement certain
best practices, failed to upgrade critical security systems, used
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 4 of 18
vulnerability of its computer network, and disregarded and/or
allegedly also failed to: hire qualified information technology
susceptibility to hackers, implement protection protocols against
malware installation, install adequate monitoring software, and to
comply with industry and Federal Trade Commission data security
Id. ¶¶ 32, 36-46.
GreenState alleges Hy-Vee’s failures harmed it - and other
financial institutions - because GreenState was required to cancel
compromised cards, reissue new cards, and reimburse members for
Id. ¶¶ 5, 49.
GreenState also alleges that
it suffered direct property damage to its payment cards and costs
due to lost interest and transaction fees.
Id. ¶ 10.
alleging claims under the Minnesota Plastic Card Security Act
declaratory and injunctive relief. On April 23, 2020, Hy-Vee moved
to dismiss for lack of personal jurisdiction or, alternatively, to
ECF No. 55.
ECF No. 19.
The court denied Hy-Vee’s motion.
Hy-Vee now moves to dismiss the complaint for failure
to state a claim.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 5 of 18
Standard of Review
To survive a motion to dismiss, “a complaint must contain
sufficient factual matter, accepted as true, to state a claim to
relief that is plausible on its face.”
Gallagher v. City of
Clayton, 699 F.3d 1013, 1016 (8th Cir. 2012) (citation and internal
quotation marks omitted).
“A claim has facial plausibility when
the plaintiff [has pleaded] factual content that allows the court
to draw the reasonable inference that the defendant is liable for
the misconduct alleged.”
Ashcroft v. Iqbal, 556 U.S. 662, 678
(citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556 (2007)).
allegations, it must raise a right to relief above the speculative
See Twombly, 550 U.S. at 555.
“[L]abels and conclusions
or a formulaic recitation of the elements of a cause of action”
are not sufficient to state a claim.
Iqbal, 556 U.S. at 678
(citation and internal quotation marks omitted).
“When considering ... a motion to dismiss ... the court
generally must ignore materials outside the pleadings, but it may
consider some materials that are part of the public record or do
Toxicology Lab., Inc., 688 F.3d 928, 931 (8th Cir. 2012) (internal
quotations and citations omitted) (citing Porous Media Corp. v.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 6 of 18
Pall Corp., 186 F.3d 1077, 1079 (8th Cir. 1999)).
consider “matters incorporated by reference or integral to the
claim, items subject to judicial notice, matters of public record,
orders, [and] items appearing in the record of the case ... without
converting the motion into one for summary judgment.”
Id. at 931,
n.3 (internal quotations omitted) (quoting 5B Charles Alan Wright
& Arthur R. Miller, Federal Practice and Procedure § 1357 (3d ed.
2004)). Therefore, the court may consider the Courtney and Tingley
declarations that were filed in support of or opposition to Hy-Vee’s previous motion to dismiss or transfer venue. 1
(considering the factual record created by a motion for temporary
restraining order, preliminary injunction, and expedited discovery
for a motion to dismiss under Fed. R. Civ. P. 12(b)(6)).
Hy-Vee argues that this suit should be dismissed because Iowa
substantive law applies under choice of law rules, and GreenState
fails to state claims under Iowa law.
GreenState responds that
the choice of law inquiry is premature.
If the court conducts the
Minnesota law applies and that it properly pleads its claims.
Both parties cite the Courtney and Tingley declarations in
their briefs as part of the factual record. The declarations do
not contradict the complaint, and both parties embrace the
materials and do not dispute their authenticity.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 7 of 18
court determines that the choice of law inquiry is appropriate at
this time and that Iowa law applies. 2
Discovery is necessary for a choice of law inquiry when it is
difficult or not possible for the court to evaluate which states’
See P.L. Banks, Inc. v. Organized Fishing, Inc., No.
Cantonis v. Stryker Corp., No. 09-cv-3509, 2010 WL 6239354, at *3
(D. Minn. Nov. 23, 2010), report and recommendation adopted, No.
09-cv-3509, 2011 WL 1084971 (D. Minn. Mar. 21, 2011).
court is satisfied that it has sufficient information to make a
choice of law determination because the factual record details
where relevant conduct took place.
See Lapushner v. Admedus Ltd.,
No. 20-cv-572, 2020 WL 5106818, at *3 (D. Minn. Aug. 31, 2020).
Federal courts sitting in diversity apply the forum state’s
conflict of laws rules.
Minn. Mining & Mfg. Co. v. Kirkevold, 87
F.R.D. 324, 331 (D. Minn. 1980).
“Minnesota’s choice-of-law rules
involve a multistep analysis.”
Whitney v. Guys, Inc., 700 F.3d
1118, 1123 (8th Cir. 2012) (citing Christian v. Birch, 763 N.W.2d
50, 56 (Minn. App. 2009)).
Under Minnesota law, the first inquiry
is whether an actual conflict of laws exists.
Nodak Mut. Ins. Co.
v. Am. Family Mut. Ins., 604 N.W.2d 91, 93-94 (Minn. 2000).
the court must determine “whether the law of both states can be
The parties do not dispute that only Minnesota and Iowa
law are relevant for the choice of law analysis.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 8 of 18
Jepson v. Gen. Cas. Co. of Wis., 513
N.W.2d 467, 469 (Minn. 1994). If there is an outcome determinative
applied, then the court applies Minnesota’s multifactor test,
which uses the Leflar factors, to determine which states’ law
should apply. Whitney, 700 F.3d at 1124 (citing Jepson, 513 N.W.2d
Outcome Determinative Conflict
A conflict exists if application of the law of either state
would be outcome determinative.
Nodak, 604 N.W.2d at 94.
is an outcome determinative conflict pertaining to the Minnesota
PCSA claim because there is no analogous Iowa statute. 3 The parties
conflict regarding GreenState’s negligence claims.
At issue is
whether Iowa’s economic loss rule bars GreenState’s negligence
The court finds that it does, and, therefore, there is an
outcome determinative conflict. 4
“A federal court sitting in diversity interprets state law
Dziadek v. Charter Oak Fire Ins. Co., 867 F.3d 1003,
1011 (8th Cir. 2017); see also Karas v. Am. Fam. Ins. Co., 33 F.3d
GreenState concedes that there is an outcome determinative
conflict in this respect.
GreenState argues that Minnesota law would not bar its
negligence claims, and Hy-Vee raises no argument in opposition.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 9 of 18
995, 1000 (8th Cir. 1994) (“As a federal court, our role is to
interpret state law in diversity cases and not to fashion it.”).
In Annett Holdings, Inc. v. Kum & Go, L.C., 801 N.W.2d 499 (Iowa
2011), the Iowa Supreme Court endorsed the economic loss rule.
“[T]he economic loss rule bars recovery in negligence when the
plaintiff has suffered only economic loss.”
Id. at 503 (citing
Neb. Innkeepers, Inc. v. Pittsburgh-Des Moines Corp., 345 N.W.2d
124, 126 (Iowa 1984)).
Without any physical or direct harm
occurring to property or persons, plaintiff cannot recover for
purely economic or business loss.
See Neb. Innkeepers, Inc., 345
N.W.2d at 126-29.
GreenState argues that payment card data is akin to “property”
that can be “damaged,” and, consequently, it is not economic loss.
The data breach rendered the payment cards, and its accompanying
additional damages, including the replacement and reissuing of
GreenState argues that, because computer data is considered
property in the criminal context, it should be considered property
in the civil context. See Iowa Code Ann. §§ 702.14, 702.01A(10).
GreenState does not cite any Iowa caselaw, however, where computer
data is considered property in the civil context, and the court
will not expand the criminal definition’s application. See Karas,
33 F.3d at 1000 (“[O]ur role is to interpret state law in diversity
cases and not to fashion it.”).
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 10 of 18
The Iowa Supreme Court held that the economic loss doctrine
bars negligence claims against a convenience store for fraudulent
and unauthorized payment card use by a third party.
Holdings, Inc., 801 N.W.2d at 506.
withdraw money for himself.
In Annett Holdings, one of
Id. at 501.
The employee would use
the payment card – which was for the purpose of purchasing fuel
and obtaining cash advances – to print cash advance slips and
presented the slips to the convenience store.
falsely claimed he was authorized to pay for other employees’ fuel
purchases, and the convenience store paid him in cash.
Plaintiff alleged that the convenience store was negligent in
providing cash to the employee.
Id. at 502.
The court held that plaintiff’s negligence claim was barred
by the economic loss rule.
Id. at 504.
The court explained that
ultimately charged to plaintiff, were indirect economic losses to
Id. at 502 (“No one was injured [and] no property was
damaged or destroyed.”).
The Iowa Supreme Court cited favorably
to and described Cumis Insurance Society, Inc. v. BJ’s Wholesale
Club, Inc., 918 N.E.2d 36 (Mass. 2009), a Massachusetts Supreme
Judicial Court case which applied the economic loss doctrine to a
“similar claim.” Id. In Cumis, credit unions and their insurers
brought negligence claims against a retailer that “improperly
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 11 of 18
stored credit card data in a manner that allowed thieves to access
the data,” resulting in fraudulent credit card use.
Cumis Ins. Society, Inc., 918 N.E.2d at 39-40).
The Cumis court
barred the credit unions’ negligence claim under the economic loss
Id. (citing Cumis Ins. Society, Inc., 918 N.E.2d at 39-
It rejected the credit unions’ contention that compromised
credits cards were tangibly damaged because the credit unions had
to replace and reissue compromised cards.
Id. (citing Cumis Ins.
Society, Inc., 918 N.E.2d at 46-47).
Here, GreenState’s negligence claim would be barred by Iowa’s
cancelling compromised cards, reissuing new cards, reimbursing
transaction fees because of reduced card use – are all indirect
GreenState’s injuries do not constitute property
damage to its members’ payment cards.
Because GreenState alleges
nothing more than economic losses, Iowa law bars its negligence
GreenState argues that Annett Holdings is distinguishable
from this case.
In Annett Holdings, plaintiff also had a contract
responsibility for unauthorized or fraudulent use of payment cards
by its employees.
The payment card issuer also had a contract
with the convenience store.
Consequently, the court found
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 12 of 18
specifically applied the “contractual economic loss rule,” which
is an economic loss theory that tort law should not replace “a
consensual network of contracts.”
Id. at 505.
that there are no allegations of a similar contract with the
payment card issuer, 6 and, consequently, Annett Holdings and the
economic loss rule are wholly inapplicable.
The court, too, finds
this argument unpersuasive.
Important to the economic loss inquiry is whether plaintiff’s
claim “bears a number of characteristics that bring it within the
scope of the economic loss rule.”
Id. at 504.
As described above,
GreenState seeks to recover remote economic loss.
the Annett Holdings court explains, the rule is not limited to
cases where parties are in direct contractual privity.
“stranger economic loss” rule prevents plaintiffs from seeking
purely economic losses from remote third parties.
Id.; see also
Neb. Innkeepers, Inc., 345 N.W.2d at 128-29 (holding that plaintiff
cannot recover purely economic losses against bridge contractor
The parties dispute whether GreenState entered into
contracts with payment card providers. Hy-Vee attaches Visa and
MasterCard Rules to its brief to argue that GreenState has
contracts with payment card issuers. GreenState does not allege
the contents of the payment card rules or contracts. The court
does not consider these rules because they are matters outside the
pleadings and are not necessarily embraced by the pleadings. See
Ashanti v. City of Golden Valley, 666 F.3d 1148, 1150–51 (8th Cir.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 13 of 18
that negligently caused bridge to close);
Anderson Plasterers v.
Meinecke, 543 N.W.2d 612, 613-14 (Iowa 1996) (refusing employer’s
negligence claim to recover economic losses from negligent third
party who injured plaintiff’s employees).
The rule aims to limit
reverberations” and “encourages parties to enter into contracts.”
Hy-Vee has no direct contractual privity with
Hy-Vee, a merchant, and GreenState, an issuing bank,
are separated by a multistep payment card transaction process and
Hy-Vee and GreenState’s connection in this
transaction is too remote, and, thus, their relationship to one
another fits squarely within the stranger economic loss rule.
GreenState’s negligence claims would be barred under Iowa
law, which makes the choice of law inquiry outcome determinative.
Constitutional Application of State Law
A state’s law may be constitutionally applied if that state
has “a significant contact or significant aggregation of contacts,
creating state interests, such that choice of its law is neither
arbitrary nor fundamentally unfair.” Jepson, 513 N.W.2d at 469-70
(quoting Allstate Ins. Co. v. Hague, 449 U.S. 302, 312–13 (1981)).
requires an inquiry into their claims’ contacts with Minnesota and
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 14 of 18
their individual state laws before concluding Minnesota law may
In re St. Jude Med., Inc., 425 F.3d 1116, 1120 (8th Cir.
“When considering fairness in this context, an important
element is the expectation of the parties.”
Co. v. Shutts, 472 U.S. 797, 822 (1985).
“Personal jurisdiction and choice of law, however,
present distinct inquiries.”
Superior Edge, Inc. v. Monsanto Co.,
964 F. Supp. 2d 1017, 1033 n.4 (D. Minn. 2013) (rejecting the
argument that because the court has personal jurisdiction over
The court’s determination regarding personal
jurisdiction does not bind it here.
Whether the court could constitutionally apply Minnesota law
is a close call.
On the one hand, the contacts of GreenState’s
claims with Minnesota are not seemingly significant.
injury – cancelling compromised cards, reissuing new cards, and
reimbursing members – is felt in Iowa.
The actions and omissions
by Hy-Vee giving rise to GreenState’s claims – its data security
decision-making and the actions of the information technology
On the other hand, Glover v. Merck & Co., Inc., 345 F.
Supp. 2d 994, 997-98 (D. Minn. 2004), suggests that Hy-Vee doing
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 15 of 18
sufficient for constitutional purposes.
Even if the court found
that it could constitutionally apply Minnesota law, the choice of
law factors weigh in favor of Iowa law.
Minnesota Choice of Law Factors
The court evaluates the following factors to determine which
law to apply: “(1) predictability of result; (2) maintenance of
interstate and international order; (3) simplification of the
interest; and (5) application of the better rule of law.” Whitney,
700 F.3d at 1124 (quoting Jepson, 513 N.W.2d at 470).
agree that the third factor is neutral and that the fifth factor
is not relevant.
Predictability of Results
predictable before the time of the transaction or event giving
rise to the cause of action ...”
Nesladek v. Ford Motor Co., 46
F.3d 734, 738 (8th Cir. 1995) (applying Minnesota law).
factor is usually “not of great importance” in tort cases because
of the “unplanned nature” of accidents.
Jepson, 513 N.W.2d at
Here, however, this factor may still tip in favor of applying
This case is not an ordinary “accidental” tort case,
like a car accident, but rather a negligence claim focusing on the
decision-making conduct of Hy-Vee and its data security employees.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 16 of 18
decision-making are located in Iowa.
It is predictable that Iowa
law would apply.
2. Maintenance of the Interstate Order
Maintenance of interstate order is satisfied “as long as the
Danielson v. Nat’l Supply Co., 670 N.W.2d 1, 8 (Minn.
Ct. App. 2003) (citation omitted).
If “a state has little or no
contact with a case and nearly all of the significant contacts are
with a sister state, the factor suggests that a state should not
apply its own law to the dispute.”
Hughes v. Wal-Mart Stores,
Inc., 250 F.3d 618, 620–21 (8th Cir. 2001) (internal quotations
and citations omitted) (applying Leflar’s factors).
This factor heavily favors Iowa law.
Both parties are Iowa
All of GreenState’s branches are in Iowa.
incurred its financial costs replacing, reissuing, and reimbursing
compromised payment cards in Iowa.
It is not enough that Hy-Vee
has approximately ten percent of its stores in Minnesota.
information technology and security employees are all in Iowa.
The actions and omissions by Hy-Vee giving rise to GreenState’s
claims – its data security decision-making and the actions of the
information technology department – are based in Iowa.
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 17 of 18
3. Advancement of State Interests
interests of the two states.”
Nesladek, 46 F.3d at 739 (quoting
Lommen v. City of East Grand Forks, 522 N.W.2d 148, 152 (Minn. Ct.
Although “a state has at least some interest in
protecting nonresidents from tortious acts committed within the
application of its law to the litigation.”
Hughes, 250 F.3d at
Moreover, there is not an important state interest furthered
“by ensuring that nonresidents are compensated for injuries that
occur in another state.”
Id. (emphasis omitted).
above, GreenState is an Iowa resident whose injury occurred in
Minnesota’s governmental interest in this tort action is
not significantly furthered, and this factor weighs in favor of
application of Iowa law.
Accordingly, the court applies Iowa law,
and, as detailed above, GreenState’s PCSA and negligence claims
must be dismissed.
Declaratory and Injunctive Relief Claim
injunctive relief, premised on its dismissed negligence claims.
Because the court dismissed GreenState’s substantive claims, it
CASE 0:20-cv-00621-DSD-DTS Doc. 78 Filed 07/19/21 Page 18 of 18
also dismisses GreenState’s claim for declaratory and injunctive
See Pickrell v. Sorin Grp. USA, Inc., 293 F. Supp. 3d
865, 869 (S.D. Iowa 2018) (citing Schilling v. Rogers, 363 U.S.
666, 677 (1960)) (explaining that the Declaratory Judgment Act is
not a cause of action without an underlying claim); Minn. Indus.
Ventures, L.L.C. v. City of Roseville, No. 05-cv-2488, 2006 WL
763208, at *5 n.4 (D. Minn. Mar. 24, 2006) (citing Great–West Life
& Annuity Ins. Co. v. Knudson, 534 U.S. 204, 211 n.1 (2002))
(explaining dismissal of substantive claim eliminates request for
injunctive relief because “an injunction is a remedy, not a cause
Accordingly, IT IS HEREBY ORDERED that:
The motion to dismiss [ECF No. 64] is granted; and
The action is dismissed with prejudice.
LET JUDGMENT BE ENTERED ACCORDINGLY.
Dated: July 19, 2021
s/David S. Doty
David S. Doty, Judge
United States District Court
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?