In Re TJX Companies Retail SEC. Breach Litigation

United States Court of Appeals
For the First Circuit

Nos. 07-2828, 08-1075, 08-1076

IN RE: TJX COMPANIES RETAIL SECURITY BREACH LITIGATION.
__________

AMERIFIRST BANK and SELCO COMMUNITY CREDIT UNION,

Plaintiffs, Appellees/Cross-Appellants,

v.

TJX COMPANIES, INC., FIFTH THIRD BANK and FIFTH THIRD BANCORP,

Defendants, Appellants/Cross-Appellees.

APPEALS FROM THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MASSACHUSETTS
[Hon. William G. Young, U.S. District Judge]

Before
Boudin, Lipez and Howard,
Circuit Judges.

Douglas H. Meal with whom Richard D. Batchelder, Jr. and Ropes
& Gray LLP were on brief for TJX Companies, Inc.
W. Breck Weigel with whom Robert N. Webner, Vorys, Sater,
Seymour and Pease LLP, James R. Carroll, Nicholas I. Leitzes and
Skadden, Arps, Slate, Meagher & Flom LLP were on brief for Fifth
Third Bank and Fifth Third Bancorp.
Joe R. Whatley, Jr. with whom Patrick J. Sheehan, Whatley
Drake & Kallas, LLC, Archie C. Lamb, Jr., F. Inge Johnstone and The
Lamb Firm, LLC were on brief for AmeriFirst Bank and SELCO
Community Credit Union.

March 30, 2009
 BOUDIN, Circuit Judge. Before us are cross-appeals

stemming from a well known incident: the theft from TJX computers

of customer credit and debit card information and the subsequent

fraudulent use of the information. See generally In re TJX Cos.

Retail Sec. Breach Litig., 493 F. Supp. 2d 1382 (D. Mass. 2007);

McMorris v. TJX, 493 F. Supp. 2d 158 (D. Mass. 2007). Law suits

ensued, this case--involving banks injured in the debacle--among

them.

In January 2007, TJX Companies, Inc. ("TJX"),

headquartered in Massachusetts and a major operator of discount

stores, revealed that its computer systems had been hacked. Credit

or debit card data for millions of its customers had been stolen.

Harm resulted not only to customers but, it appears, also to banks

that had issued the cards ("issuing banks"), which were forced to

reimburse customers for fraudulent use of the cards and incurred

other expenses.

In May 2007, AmeriFirst Bank, based in Alabama, filed

suit in the federal district court in Massachusetts against TJX

and, in addition, against an Ohio bank and its parent--Fifth Third

Bank and Fifth Third Bancorp (collectively "Fifth Third").1 Fifth

1
The suit against TJX included other named plaintiffs who have
since settled. A second AmeriFirst suit, with another named
plaintiff (SELCO--a credit union in Oregon), was filed against
Fifth Third in the district court. The two cases were consolidated
and, as allegations against Fifth Third in the second suit mirror
those in the first, we refer only to "the complaint."

-2-
Third served as "processing bank" for TJX transactions, receiving

the data from the customer's initial charge for a purchase and,

after high-speed verification from the issuing bank, authorizing

the charge. Visa and Mastercard each had a network and regime for

such purposes.

AmeriFirst's complaint, seeking class action status for

issuing banks, charged that both TJX and Fifth Third were variously

at fault: that TJX and Fifth Third failed to follow security

protocols prescribed by Visa and MasterCard to safeguard personal

and financial information; that the breaches occurred from July

2005 onward but were discovered and disclosed only later; and that

the issuing banks suffered losses from reimbursing customers for

fraud losses, monitoring customers accounts, and cancelling and

reissuing cards.

The multi-count complaint charged (1) negligence, (2)

breach of contract, (3) negligent misrepresentation, and (4) unfair

or deceptive practices under chapter 93A, Mass. Gen. Laws ch. 93A

(2008). The defendants moved to dismiss for failure to state a

claim. Fed. R. Civ. P. 12(b)(6). On October 12, 2007, the

district court dismissed the negligence and breach of contract

claims but refused to dismiss claims based on negligent

misrepresentation and chapter 93A. (A fifth claim, for "negligence

per se," was dismissed and is not at issue.) In re TJX Cos. Retail

Sec. Breach Litig., 524 F. Supp. 2d 83.

-3-
 Plaintiffs then moved to amend their complaint, seeking

to add a claim for conversion and also new facts to the chapter 93A

claim. On November 29, 2007, the district court provisionally

denied class status; if made final, this denial would in turn

defeat subject matter jurisdiction based on the minimal diversity

provisions of the Class Action Fairness Act, 28 U.S.C. § 1332

(2006). The court invited briefing as to whether, if class action

status were ultimately denied, it should transfer the case to state

court. In re TJX Cos. Retail Sec. Breach Litig., 246 F.R.D. 389.

On December 18, 2007, the court denied the motion to

amend the complaint, it made the denial of class status final, and

it ordered the transfer of the case to the Massachusetts Superior

Court. Although all but two of the claims had been dismissed, the

district court designated its pre-transfer rulings as "without

prejudice" to reconsideration by the state court. At defendants'

request, this court stayed the transfer pending review on appeal.

TJX and Fifth Third now appeal to this court, urging

principally that all claims against them should have been dismissed

with prejudice and that in any event transfer to the state court

was precluded by governing precedent. AmeriFirst and SELCO raise

standing and finality objections to defendants' appeal and ask for

affirmance of the transfer order; but by cross appeal, they say

that dismissal of their other claims was error and that both class

action status and the motion to amend should have been allowed.

-4-
 Jurisdiction, Standing and Finality. Although no party

has questioned it, we are compelled to consider first an oddity

that might seem to imperil subject matter jurisdiction.

Jurisdiction in the district court rested on the minimum diversity

provision available only for class actions, 28 U.S.C. § 1332, and

ultimately the district court ruled that class certification was

improper. So one might ask: how do the parties now get to litigate

on the merits whether specific counts did or did not state claims?

The answer is the district judge had provisional

jurisdiction to decide those merits issues--because whether class

action status was sustainable depended in part on what claims were

on the table. "In such cases it is both proper and necessary for

the trial court first to resolve the merits of the claim to the

extent necessary to allow the court to properly determine its own

jurisdiction." Augustine v. United States, 704 F.2d 1074, 1079

(9th Cir. 1983). See generally Bell v. Hood, 327 U.S. 678 (1946).

In the end, after disposing of standing and finality

objections, our analysis of the claims--both those sustained and

those dismissed--leads us to agree for the most part with the able

district judge's analysis (although not with the transfer order)

but to disagree in one respect that reopens the class action issue.

We therefore end by remanding for further proceedings as explained

below.

-5-
 The standing and finality objections are directed to bar

defendants' argument that two remaining counts of the complaint--

negligent misrepresentation and chapter 93A--should have been

dismissed. Plaintiffs say that because the district court

dismissed other counts and thereafter transferred the case, the

merits rulings against the defendants on the remaining counts

caused no harm to them, beyond speculative collateral estoppel

effects that might flow from the rulings in future litigation.

Because the district court ruled that the two counts

stated viable claims, the defendants were plainly and concretely

disadvantaged: instead of an end to the liability claims, they now

face further litigation of these claims (indeed, in this very case,

because the transfer turns out to be invalid and the claims may

still end up going forward in the district court). They are thus

entitled to appeal from the adverse ruling--assuming that the

ruling is embodied in a final judgment. 28 U.S.C. § 1291.

Ordinarily a defendant may not appeal from a denial of

a Rule 12(b)(6) motion because the litigation in the trial court

will not have concluded. But here the district court brought the

case before it to an end by the class action ruling and purported

transfer. Appeals from transfers between federal courts are

sometimes immediately appealable and sometimes not; but where the

transfer court lacks power to transfer, an order purporting to do

so can hardly defeat review of an otherwise final judgment.

-6-
 Plaintiffs also argue that the defendants' appeal is

barred because the district court said that its merits rulings were

without prejudice to reconsideration by the state courts.

Dismissals without prejudice are sometimes deemed to prevent an

immediate appeal where they represent an invitation to a plaintiff

to cure some technical deficiency by re-filing in the same court.

E.g., Umbenhauer v. Woog, 969 F.2d 25, 30 (3rd Cir. 1992). In this

case, no such invitation was extended by the district court.

Finally plaintiffs invoke Balcom v. Lynn Ladder &

Scaffolding Co., 806 F.2d 1127 (1st Cir. 1986), which refused to

allow a third-party defendant, vindicated by a jury, to appeal from

a judgment in its favor. This defendant wanted to challenge jury

findings, fearing that they would prejudice it in future

litigation. This court said that the findings were not essential

to the judgment and thus would have no collateral estoppel effect.

Id. at 1127. Balcom is clearly not on point.

Negligent misrepresentation. We therefore turn to the

merits of defendants' appeal, starting with the negligent

misrepresentation claim which the district court found adequately

alleged for purposes of Rule 12(b)(6). Review of Rule 12(b)(6)

rulings is de novo. First Medical Health Plan, Inc. v. Vega-Ramos,

479 F.3d 46, 51 (1st Cir. 2007). At the outset, one has to

understand the nature of the claim as stated in the complaint and

-7-
as thereafter clarified by the plaintiffs in resisting the motion

to dismiss.

The complaint alleged that Fifth Third has contracts with

MasterCard and Visa that require compliance with operating

regulations adopted by each credit card organization and that TJX

and Fifth Third similarly have a contract that requires TJX to

comply with such regulations. It further alleged that TJX and

Fifth Third ignored security measures required by the operating

regulations--for examples, that signatories deploy a firewall

configuration, protect stored data, encrypt transmission of

cardholder data, and track access to cardholder data and network

resources.

But although TJX and Fifth Third are charged in the

complaint with misrepresentations, the plaintiffs' claim--as

elaborated their district court filings and brief on appeal--

appears to rest (with one doubtful exception as to Fifth Third2) on

a flimsier foundation than actual misrepresentation. Rather,

plaintiffs argue that by accepting credit cards and processing

payment authorizations, defendants impliedly represented that they

2
The possible exception is that the complaint alleges that
Fifth Third is a member of an organization that promotes security
measures and is so listed on its website and that, in context, this
amounts to an affirmative representation of compliance with various
standards; but it is not apparent that the website contains the
missing affirmative representations implied by the complaint, and
plaintiffs' brief to us does not rely on this allegation in
defending the claim but rather on the conduct theory just noted.

-8-
would comply with MasterCard and Visa regulations and this was the

negligent misrepresentation.

Massachusetts law defines negligent misrepresentation

using the Restatement (Second) of Torts (1977), which in section

552 requires the following elements:

One who, in the course of his business,
profession or employment, or in any other
transaction in which he has a pecuniary
interest, supplies false information for the
guidance of others in their business
transactions, is subject to liability for
pecuniary loss caused to them by their
justifiable reliance upon the information, if
he fails to exercise reasonable care or
competence in obtaining or communicating the
information.

Nycal Corp. V. KPMG Peat Marwick LLP, 426 Mass. 491, 495-96

(1998)(quoting the Restatement).

It would almost surely stretch Massachusetts law too far

to say that merely doing credit card transactions with issuing

banks, whether directly (Fifth Third) or indirectly (TJX), is a

representation implied by conduct to third parties that the

defendants were complying with detailed security specifications of

Visa and MasterCard. The implication is implausible and converts

the cause of action into liability for negligence--without the

limitations otherwise applicable to negligence claims.

Conduct can be part of a representation, but the link

between the conduct and the implication is typically tight. Thus,

in Danca v. Taunton Sav. Bank, 385 Mass. 1, 9 (1982), the court

-9-
upheld an implied representation claim where plaintiffs, in applying

for a mortgage, were told by the bank that it needed to assure

compliance with a zoning requirement; later by a combination of

words and action, the bank led the plaintiffs to believe that the

bank had found compliance. More recently the SJC said of Danca:

We emphasized the importance to our decision
of the defendant's "conduct and words" and
"response to the plaintiffs' inquiry," holding
it sufficient "that the representation was
reasonably understood as a statement that the
bank employees had looked at the plan and
found no problems."

Page v. Frazier, 388 Mass. 55, 66-67 (1983) (quoting Danca, 385

Mass. at 9).

Yet we stop short of holding that the district court had

to dismiss the misrepresentation claim in this case on the face of

a complaint that explicitly alleged misrepresentation. Recently

the Massachusetts trial court refused to dismiss virtually the same

claim brought by credit unions against Fifth Third and another

defendant for credit card losses resulting from a security breach.

CUMIS Ins. Soc., Inc. v. BJ's Wholesale Club, Inc., 23 Mass. L. Rep.

550 (Mass. Super. 2005). Plaintiffs naturally rely on this

decision, as did the district court.

Then, on summary judgment in CUMIS, it became crystal

clear that the charge of "misrepresentation" rested simply on the

doing of credit card business--the same implication from conduct

argument that plaintiffs offer in this case. The CUMIS court then

-10-
granted summary judgment for defendants because inter alia such

conduct was not a misrepresentation under Massachusetts law. CUMIS

Ins. Soc., Inc. v. BJ's Wholesale Club, Inc., 24 Mass. L. Rep. 117,

*11-12 (Mass. Super. 2008). The ultimate disposition is therefore

far more helpful to defendants.

Ordinarily a district court does not have to look behind

the complaint and grant a motion to dismiss because later statements

by the plaintiff offer a narrower picture of what plaintiff expects

to prove at trial. Had the second CUMIS decision been available,

the district court might well have granted the motion, but summary

judgment is the more common method of disposing of claims that are

facially valid but prove (usually after discovery) to be unsupported

by evidence. The present claim thus survives, but on life support.

Chapter 93A. The provisions of chapter 93A invoked by

plaintiffs, M.G.L. ch. 93A §§ 2, 11, pertinently provide for a claim

for "unfair" or "deceptive" trade practices as between businesses--

the unfairness label in these provisions being a cross-reference to

more specific standards borrowed from an appropriate source of law.

Ciardi v. F. Hoffmann-La Roche, Ltd., 436 Mass. 53, 70-72 (2002).

Plaintiffs offered three different theories invoking specific

standards:

•negligent misrepresentation (already alleged
as a separate tort) under Massachusetts law,

-11-
 •violation of section 5 of the Federal Trade
Commission Act, 15 U.S.C. § 45(a)(1) (2006),
which chapter 93A cross-references,3 and

•violation of a federal statute that protects
information that customers confide to
financial institutions, Gramm-Leach-Bliley
Act, 15 U.S.C. § 6801 (2006).

The district court sustained only the first of these theories and

it rejected the other two.

The negligent misrepresentation claim is likely to have

no future in this case for reasons just explained and, if it falls,

so too does its use under chapter 93A. Townsends, Inc. v. Beaupre,

47 Mass. App. Ct. 747, 755 (1999). Further, the district court

found--and we below uphold its ruling--that the negligent

misrepresentation claim, whether standing alone or under chapter

93A, is not certifiable under the class action rubric. This brings

us to the second theory (plaintiffs have abandoned the third).

Plaintiffs contend that their second theory--that

defendants' lack of security measures was "unfair" under the Federal

Trade Commission Act--provides an alternative basis for its chapter

93A claim. The district court disagreed, saying that the unfairness

characterization rested on consent decrees of the Federal Trade

3
M.G.L. ch. 93A § 2 ("It is the intent of the legislature that
in construing paragraph (a) of this section . . . courts will be
guided by the interpretations given by the [FTC] and the Federal
Courts to section 5(a)(1) of the [FTCA]."), as well as case law,
see PMP Associates, Inc. v. Globe Newspaper Co., 366 Mass. 593, 595
(1975) (Chapter 93A "directs us to consider the interpretations of
unfair acts and practices under s.5 of the Federal Trade Commission
Act . . . .").

-12-
Commission and (the court said) a consent decree is not under

Massachusetts law an authoritative determination for purposes of

chapter 93A. Whitinsville Plaza, Inc. v. Kotseas, 378 Mass. 85, 101

(1979). Plaintiffs read the case more narrowly.

However Whitinsville may be read, plaintiffs' claim here

rests on far more than consent decrees, which sometimes do go beyond

legal obligations. Specifically, they invoke (1) an FTC complaint

against TJX based on the very security lapse charged here and (2)

at least two other cases in which the FTC ruled that similar conduct

violated the Federal Trade Commission Act.4 The FTC complaint

against TJX states (in paragraph 12):

[R]espondent's failure to employ reasonable
and appropriate security measures to protect
personal information caused or is likely to
cause substantial injury to consumers that is
not offset by countervailing benefits to
consumers or competition and is not reasonably
avoidable by consumers. This practice was and
is an unfair act or practice.

Use of FTC precedent--certainly as to decided cases like

DSW and BJ's--is directly supported by chapter 93A itself. Further,

Massachusetts case law treats FTC complaints as an expression of the

4
FTC Complaint, In the Matter of The TJX Companies, File No.
072-3055; Press Release, Fed. Trade Comm'n, Agency Announces
Settlement of Separate Actions Against Retailer TJX, and Data
Brokers Reed Elsevier and Seisint for Failing to Provide Adequate
Security for Consumers' Data (Mar. 27, 2008) (the release says that
over twenty FTC complaints have been brought against similar
conduct by other companies); In re DSW Inc., Docket C-4157, 2006 WL
752215 (F.T.C. Mar. 7, 2006); In re BJ's Wholesale Club, Inc.,
Docket C-4148, 2005 WL 2395788 (F.T.C. Sept. 20, 2005).

-13-
FTC's views, Schubach v. Household Fin. Corp., 375 Mass. 133, 135

(1978) (relying in part on “several complaints” issued by the FTC),

and adjudicated FTC complaints are even more potent. So the chapter

93A claim can go forward on this second theory unless derailed by

two TJX counter-arguments--to which we now turn.

The first--that chapter 93A requires a closer association

than its indirect connection with AmeriFirst--was answered by the

district court. Case law does require a business relationship,

e.g., Imprimis Investors, LLC v. KPMG Peat Marwick LLP, 69 Mass.

App. Ct. 218, 230-31 (2007), but here a jury might say that TJX was

regularly seeking payment from the issuing banks through an

intermediary (Fifth Third) and that this is a close enough

connection. At least at the complaint stage, this seems enough.

TJX next argues correctly that chapter 93A is intended

exclusively for egregious conduct, see Ahern v. Scholz, 85 F.3d 774,

797-98 (1st Cir. 1996), and--it contends--that either deliberate

wrongdoing or personal benefit is present in virtually all of the

sound case law. Perhaps policy might make this a desirable stopping

point, given the vagueness of the unfairness standard and

availability of a private damages remedy unchecked by agency

prudence.

But Massachusetts decisions do not say that deliberate

wrongdoing or self-benefit are required; seemingly systematic

-14-
recklessness may suffice.5 Knowing so little about the extent of

TJX's or Fifth Third's fault at the complaint stage, we think that

at best TJX's argument is one that would have to await discovery and

perhaps a summary judgment motion. The procedural caution shown in

CUMIS is easily justified on this issue.

Finally, Fifth Third argues that the chapter 93A claim

must fail against it because none of its acts occurred “primarily”

or “substantially” within Massachusetts. See M.G.L. ch. 93A, § 11.

But again, the allegations are sufficient at this stage. Fifth

Third is alleged to have an office or offices in Massachusetts,

which under CUMIS is arguably sufficient, 23 Mass. L. Rep. 550, at

*16-17; and presumably Fifth Third's communicating to and from TJX's

servers in Massachusetts is part of the causal chain.

One final point as to the unfairness-based claim under

chapter 93A. The district court indicated, in its decision on

October 12, 2007, that federal subject matter jurisdiction might

independently attach to such a claim--regardless of class action

status--because a federal issue might be deemed embedded in the

5
See Briggs v. Carol Cars, Inc., 407 Mass. 391, 396-97 (1990)
("We also reject the argument that the judge erred in concluding
that the defendant's representation was recklessly made. It is
enough that the judge found on adequate evidence that the defects
in the vehicle were readily ascertainable by the defendant. If a
statement of fact which is susceptible of knowledge is made as of
one's knowledge and is false, it may be the basis of an action for
deceit); Pietrazak v. McDermott, 341 Mass. 107, 109-10 (1960). See
also Kozdras v. Land/Vest Properties, Inc., 382 Mass. 34, 43
(1980); Glickman v. Brown, 21 Mass. App. Ct. 229, 235 (1985).

-15-
state law claim. It did not pursue the issue because it rejected

the theory; but we are now reinstating that theory and class action

status is at best uncertain.

The embedded issue theory, associated with Smith v.

Kansas City, 255 U.S. 180 (1921), raises a complicated and much

mooted problem as to the proper construction of the "federal

question" statute. 28 U.S.C. § 1331. The answer may not matter in

this case: the district court's class-action analysis suggested that

because individual bank recoveries may be small, the plaintiffs may

have no practical interest in pursuing this case unless

certification is granted.

But if the Smith theory becomes critical, jurisdiction

should not be assumed merely because the state claim resorts to

federal precedent; nor is it perfectly clear that Massachusetts

regards the section 5 standard as binding (as opposed to merely

informative precedent to be considered)--which would arguably not

suffice even under Smith. It is enough to warn that there is

precedent and commentary that would have to be consulted and briefed

if and when necessary.6

6
See Erwin Chemerinsky, Federal Jurisdiction § 5.2, at 289-95
(5th ed. 2007); Grable & Sons Metal Prod., Inc. v. Darue
Engineering & Mfg., 545 U.S. 308, 315 (2005); Cambridge Literary
Prop., Ltd. v. W. Goebel Porzellanfabrik G.m.b., 510 F.3d 77, 95-96
(1st Cir. 2007); PCS 2000 LP v. Romulus Telecomm., Inc., 148 F.3d
32, 35 (1st Cir. 1998).

-16-
 Negligence. Plaintiffs say that the district court erred

in dismissing their simple negligence claim, a ruling that it based

upon the so called economic loss doctrine. Massachusetts, which is

not alone, holds that “purely economic losses are unrecoverable in

tort and strict liability actions in the absence of personal injury

or property damage." Aldrich v. ADD Inc., 437 Mass. 213, 222

(2002). Like "duty" and "proximate cause," the doctrine cabins what

could otherwise be open-ended negligence liability to anyone

affected by a negligent act.

AmeriFirst says that it did suffer property damage

because it had a property interest in the payment card information,

which the security breach rendered worthless. Electronic data can

have value and the value can be lost, but the loss here is not a

result of physical destruction of property. Indeed, a reduction in

real property value, by dumping of contaminants in the neighborhood

but not on plaintiff's property was held to be economic loss. Lewis

v. General Electric, 37 F.Supp.2d 55 (D. Mass. 1999).

Plaintiffs offer policy arguments for limiting the

economic loss doctrine, but the physical injury requirement reflects

existing precedent, Lewis; Am. Tel. & Tel. Co. v. IMR Capital Corp.,

888 F. Supp. 221, 247 (D. Mass. 1995). CUMIS itself invoked the

economic loss doctrine to bar a negligence claim on the same facts.

23 Mass. L. Rptr. 550, at *8-9. Accord, Pa. State Employees Credit

Union v. Fifth Third Bank, 398 F. Supp. 2d. 317, 326 (M.D. Pa.

-17-
2005). Nor will we certify an issue where state law is clear.

Cantwell v. Univ. of Mass., 551 F.2d 879, 880 (1st Cir. 1977).

Breach of contract. Plaintiffs also do not persuade us

that the district court erred in dismissing their contract claims.

Here, Visa and Mastercard bound participating banks like Fifth Third

to certain security procedures and approving banks like Fifth Third

bound sellers like TJX for whom they processed payments; but the

issuing banks were not parties to either of these contracts and can

therefore bring claims only if they were third-party beneficiaries.

Massachusetts law follows the third-party beneficiary

test of the Restatement (Second) of Contracts § 302 (1981), see Rae

v. Air-Speed, Inc., 386 Mass. 187, 195 (1982), which is relatively

hospitable to claims by those purporting to be third-party

beneficiaries--except where the direct parties to the contract have

"otherwise agreed." Section 302(1) states:

Unless otherwise agreed between promisor and
promisee, a beneficiary of a promise is an
intended beneficiary if recognition of a right
to performance in the beneficiary is
appropriate to effectuate the intention of the
parties and . . . the circumstances indicate
that the promisee intends to give the
beneficiary the benefit of the promised
performance.

The parties to the contracts in this case appear to have

"otherwise agreed." The agreement between Fifth Third and TJX

provides: "This Agreement is for the benefit of, and may be enforced

only by, Bank and Merchant . . . and is not for the benefit of, and

-18-
may not be enforced by any third party." Plaintiffs argue that this

express language is superceded by provisions in the Mastercard and

Visa Operating Regulations. The regulations do say that they

prevail where they conflict with provisions in the merchant

agreements, but here the regulations do not conflict.

Instead, the MasterCard Operating Regulations state that

MasterCard "shall have the sole right to interpret and enforce" its

regulations, and the Visa Operating Regulations say that they "do

not constitute a third-party beneficiary contract as to any entity

or person . . . or confer any rights, privileges, or claims of any

kind as to any third parties." CUMIS is in accord. 23 Mass. L.

Rptr. 550, at *5-6. See also Pa. State Employees Credit Union, 398

F. Supp.2d at 323-26.

Conversion. Plaintiffs did not plead a claim for

conversion in their original or amended complaint but sought to add

it on October 25, 2007, a month after submitting the amended

complaint. The district court denied the motion on the ground that

the claim was not viable, saying that conversion related only to

interference with tangible property, and that plaintiffs claim

concerned intangible property. We review this denial for abuse of

discretion. Aponte-Torres v. Univ. of P.R., 445 F.3d 50, 58 (1st

Cir. 2006).

-19-
 Whether or not Massachusetts limits conversion claims to

tangible property is debatable,7 but even if it does not, such a

claim is less than a neat fit. Conversion implies appropriation,

which is hardly the first word that comes to mind--to describe the

store's behavior--when a customer gives a store a credit card and

the data is then filched from the store by a third party. Still,

the conversion concept is loosely defined, under Massachusetts law

as elsewhere, e.g., Kelley v. LaForce, 288 F.3d 1, 11-12 (1st Cir.

2002); so perhaps this too is a debatable issue.

In all events, the claim is not straightforward, could

have been presented in the original complaint, and does not depend

on newly discovered facts. The district court's decision not to

entertain a belated claim on top of numerous ones already pled and

under consideration, was not an abuse of discretion. Nor did the

court have to allow belated amendment of the chapter 93A claim to

add facts that could have been asserted earlier.

Class certification. After determining which claims

survived, the district court then applied the customary tests to

decide whether class action status could be sustained for the case,

see Fed. R. Civ. P. 23(a), (b), and provisionally concluded that

certification was not justified. This judgment was explicitly

limited to the two claims that survived. Ultimately, the district

7
Compare John G. Danielson, Inc. v. Winchester-Conant Props.,
Inc., 186 F. Supp. 2d 1, 28 (D. Mass. 2002), with Discover Realty
Corp. v. David, 2003 Mass. App. Div. 172, 175 (2003).

-20-
court denied the request to amend and made final its denial of class

status.

Plaintiffs expressly decline to appeal from the denial of

class certification of the two claims in question--the negligent

representation claim and the chapter 93A claim resting on the same

theory. But arguing that some of the district court's discussion

is mistaken, or overcome by proffered amendments to the class

definition, they express concern that some of the discussion might

imperil certification on remand of any other claim that we might

reinstate on appeal--which is just what we are doing.

Conversely, TJX (although for intricate reasons not Fifth

Third) appears to agree that the district court's denial of

certification is mooted by plaintiffs' failure to appeal it; but

defendants themselves urge that--should we reinstate any of the

dismissed claims--we "affirm" the denial of certification and

"conclude that it precluded class certification of any revived

claims(s)." In other words, both sides suggest that we resolve,

although in opposite ways, a question not reached by the district

court.

The district court's resolution of the certification

issue before it--not to certify the negligent misrepresentation

claim--turned primarily on its conclusion that that claim required

proof of individual reliance on the misrepresentation--directly so

for the tort claim and at least indirectly so for the chapter 93A

-21-
claim. On this basis, the district court found that class issues

would not predominate over individual-party issues, defeating the

only Rule 23(b) precondition that the court deemed viable.

It is not clear to us whether a chapter 93A claim based

on an unfairness theory would necessarily raise the same problem or

be barred on the same basis. The unfairness theory appears to look

to what the defendants did (or failed to do) rather than on the

banks' reliance on supposed misrepresentations; but the district

court's discussion of proof of causation of loss as a separate

individual-party issue may (or may not) apply to unfairness claims

as well. Neither side has briefed this issue and obviously the

district court has not decided it.

The district court also expressed concern about whether

the putative class was properly defined by plaintiffs and about

whether plaintiffs could provide fair and adequate representation,

also a precondition for class status. Fed R. Civ. P. 23(a)(4). But

the former concern might perhaps be cured by the proffered

amendments; and the latter directly related to the claims against

Fifth Third and the conflicting economic interests of banks that are

both issuers and acquirers; claims against TJX might be unaffected.

The district court showed an enviable mastery of class

action law and analysis, and the wisest course is to let it decide

in the first instance whether the chapter 93A unfairness theory

merits class status. To pick apart an integrated analysis and

-22-
comment on specific reasons, as plaintiffs urge, would be unsound;

it would be even more unsound to decide, as defendants urge, the

class status of the revived claim unless and until the district

court considers the issue and it is properly briefed to us.

Transfer. Having denied certification, the district

court concluded that the case could not proceed in federal court,

partly because too little was at stake for the individual plaintiffs

but primarily because ordinary diversity is lacking once the minimal

diversity provided for a qualified class action fails. Defendants

attack, and plaintiffs defend, the transfer order--authority to

transfer being "a legal question we review de novo." Mills v.

Maine, 118 F.3d 37, 51 (1st Cir. 1997) (citation omitted).

Mills squarely decided "that, in the absence of any

specialized state statute, 'it is the duty of the trial court, if

it finds that jurisdiction does not exist, to proceed no further but

to dismiss the suit.'" Id. at 52 (emphasis in original) (quoting Joy

v. Hague, 175 F.2d 395, 396 (1st Cir. 1949)). Most of Mills'

reasoning would apply even if there were a Massachusetts statute

authorizing such a transfer, compare Weaver v. Marine Bank, 683 F.2d

744 (3rd Cir. 1982); anyway, no such statute is invoked.

Mills' ruling on transfers to state courts was not, as

has been suggested, merely dictum. In Mills, the district court had

refused to transfer to state court a suit that fell outside its own

subject matter jurisdiction and on appeal appellants insisted that

-23-
the district court should have transferred the case to state court.

This court then considered the claim and decided that the district

court had no authority to make such a transfer. This holding binds

district courts and, indeed, this panel. Muskat v. United States,

554 F.3d 183, 189 (1st Cir. 2009).

In ordering transfer, the district court said that its

prior merits rulings were "'without prejudice' to reexamination in

the courts of the Commonwealth." TJX says that this too was error.

The "without prejudice" label has different meanings in different

contexts, e.g., In re Sonus Networks, Inc., 499 F.3d 47, 60 n.6 (1st

Cir. 2007); perhaps the district judge meant only that a transferee

court can revisit its prior rulings in the same case. Rio Mar

Assocs., LP v. UHS of P.R., Inc., 522 F.3d 159, 167 (1st Cir. 2008).

It would be quite another matter to decide a merits issue

but then purport to deprive the decision of res judicata effect in

future cases--a matter governed by established rules. E.g., Ramallo

Bros. Printing, Inc. v. El Dia, Inc., 490 F.3d 86 (1st Cir. 2007).

But the "without prejudice" gloss here was commentary incident to

the transfer order and, as we are vacating that order and remanding

the case, we treat the characterization as falling with the order.

Accordingly, we affirm (1) the district court's dismissal

of the negligence and breach of contract claims, (2) its denial of

the motion to amend the complaint, and (3) its sustaining of the

negligent misrepresentation claim (and use as a theory under chapter

-24-
93A, but without prejudice to a motion by defendants for summary

judgment), but we vacate (4) its dismissal of the chapter 93A claim

based on the unfairness theory and (5) its transfer order and no-

prejudice ruling, and we remand for further proceedings consistent

with this decision. Each party will bear its own costs on the

appeal.

It is so ordered.

-25-