Sovereign Bank v. BJ's Wholesale Club, Inc.

Summarize Case

Related Cases

395 F. Supp. 2d 183 (2005)

SOVEREIGN BANK, Plaintiff
v.
BJ'S WHOLESALE CLUB, INC., Fifth Third Bankcorp. Defendants.

No. Civ. 1:CV-05-1150.

United States District Court, M.D. Pennsylvania.

October 18, 2005.

*184 *185 *186 *187 Christopher Grant Barnes, Stevens & Lee PC, Cherry Hill, NJ, Joseph Wolfson, Stevens & Lee, P.C., King of Prussia, PA, for Plaintiff.

Christopher A. Lewis, Mark L. Rhoades, Richard L. Kremnick, Blank Rome LLP, Philadelphia, PA, Andrew L. Swope, Christopher R. Nestor, Kirkpatrick & Lockhart Nicholson Graham LLP, Harrisburg, PA, Melvin A. Bedree, William B. Weigel, Vorys Sater Seymour and Pease LLP, Cincinnati, OH, for Defendants.

MEMORANDUM

CALDWELL, District Judge.

I. Introduction.

This case stems from a breach of the computer system used by defendant, BJ's Wholesale Club, Inc., a wholesale club retailer. The system was hacked and bank-card numbers were stolen, allegedly because the computer program BJ's used to process card transactions improperly retained card numbers rather than merely keep them in the system only for the seconds required to validate the transaction.

Some of the numbers stolen belonged to customers of plaintiff, Sovereign Bank. Sovereign filed this lawsuit seeking damages, mainly for the cost of issuing new credit cards to replace the ones that had been compromised by the theft and for the cost of reimbursing those card holders who had suffered unauthorized charges to their accounts. Sovereign participates in the system operated by Visa USA Inc., so the cards were Visa cards.

The case was filed in state court against BJ's and Fifth Third Bank Corp., an affiliate of Fifth Third Bank, the bank that *188 processes card transactions for BJ's.[1] It was removed here on the basis of diversity jurisdiction. 28 U.S.C. §§ 1332(a) and 1441(a). The complaint has six counts. The two defendants have each been sued for breach of contract, negligence and indemnity.[2]

The defendants have filed separate motions to dismiss under Fed.R.Civ.P. 12(b)(6), arguing that none of the claims states a valid cause of action. BJ's motion argues as follows. First, Sovereign has no breach-of-contract claim against it because Sovereign is not a party to BJ's contract with Fifth Third, the contract at issue, and it is also not a third-party beneficiary of that contract either, because of a specific exclusion in the contract of third parties as beneficiaries. Second, Sovereign has no negligence claim because it bases that claim on BJ's breach of alleged contractual duties, and Pennsylvania's "gist of the action" doctrine bars a negligence claim that merely restates a breach-of-contract claim, even when that breach-of-contract claim is itself invalid. Additionally, the negligence claim fails on the causation element because any damages Sovereign incurred were caused by the criminal actions of those who broke into BJ's computer system, not BJ's negligence. Further, Sovereign has alleged only economic losses, and such losses are barred from recovery in a negligence claim by the economic loss doctrine. Third, the indemnity claim fails because Sovereign cannot show that its liability to its cardholders is secondary to BJ's liability, a necessary element of a noncontractual indemnity claim.

In its motion, Fifth Third argues as follows. First, Sovereign has no breach-of-contract claim against it because Sovereign is not a third-party beneficiary of Fifth Third's contract with Visa, the basis of the contract claim against Fifth Third. Second, Sovereign has no negligence claim because Sovereign cannot rely upon a breach of duty arising from alleged contractual obligations to establish a breach of the duty of reasonable cause in a negligence claim. Also, under the economic loss doctrine Sovereign cannot seek recovery in negligence without physical harm to person or property. Third, the indemnity claim fails because: (1) Sovereign is entitled to indemnity only if Fifth Third committed a tort against the cardholders, and it committed no tort; (2) Sovereign is entitled to indemnity only if its cardholders suffered a loss, but they did not do so because federal law imposes the loss for the unauthorized charges on Sovereign and excuses the cardholders; (3) Sovereign cannot be secondarily liable to Fifth Third because Sovereign accuses Fifth Third of failing to detect the defect in BJ's computer system, a theory of secondary liability itself; and (4) Sovereign cannot be secondarily liable because both contractual obligations and federal law make Sovereign primarily liable for the fraudulent transactions.

II. Standard of Review.

In considering Defendants' motions to dismiss, we must accept as true the factual allegations in the complaint and construe any inferences to be drawn from them in Plaintiff's favor. See Mariana v. Fisher, *189 338 F.3d 189, 195 (3d Cir.2003). We may dismiss a complaint under Fed.R.Civ.P. 12(b)(6) only if it is clear that no relief could be granted to Plaintiff under "any set of facts that could be proven consistent with the allegations." Ramadan v. Chase Manhattan Corp., 229 F.3d 194, 195 (3d Cir.2000). The court is not limited to evaluating the complaint alone; it can also consider documents attached to the complaint, matters of public record, and other documents that are indisputably authentic. Pension Ben. Guar. Corp. v. White Consol. Indus., 998 F.2d 1192, 1196 (3d Cir.1993). The court may also consider "documents whose contents are alleged in the complaint and whose authenticity no party questions," even though they "are not physically attached to the pleading...." Pryor v. Nat'l Collegiate Athletic Ass'n, 288 F.3d 548, 560 (3d Cir.2002).

III. Background.

The complaint alleges the following. Sovereign is a federal savings and loan association with its principal place of business in Wyomissing, Pennsylvania. (Doc. 2, Attach.1, Compl.¶ 1.) Visa is a "membership association" owned and controlled by its members. (Id. ¶¶ 6 and 8.) An "issuing member" issues Visa cards to cardholders; the relationship is contractual. (Id. ¶ 10.) An "acquiring member" enters into contracts with "merchants," (id. ¶ 11), to process card transactions at the retail end. For the purposes of the lawsuit, Sovereign is an issuing bank and Fifth Third an acquiring bank. (Id. ¶¶ 13 and 14.) A "merchant" allows cardholders to access the Visa payment system by using their Visa cards to pay for the goods or services the merchant offers. (Id. ¶ 12.)

Fifth Third and BJ's have contracted by way of two merchant agreements. One governs the processing of debit-card transactions (Doc. 3, BJ's Ex. A) and the other credit-card transactions. (Id., BJ's Ex. B.) Both contain the following language, quoting in pertinent part from paragraph 16 of each agreement: "This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." Both agreements also have a choice-of-law provision, requiring them to be "governed, construed and enforced" under Ohio law. (Id., Exs. A and B, ¶ 23.)

A bank card contains account information on the cardholder in a magnetic stripe on the back of the card. (Compl. ¶¶ 19 and 20.) To complete a transaction, the merchant often runs the card through a magnetic-stripe terminal, which acquires the cardholder information and sends it to the issuing bank. (Id. ¶ 19.) The issuing bank then reviews the information and if everything is valid, approves the transaction. (Id. ¶ 20.) The merchant then completes the transaction with the cardholder. (Id. ¶ 21.)

Visa has extensive by-laws and operating regulations. (Id. ¶ 7.) To become a member, a financial institution must agree to abide by the operating regulations. (Id. ¶ 16.) The operating regulations require an acquiring bank to compel its merchants to abide by the operating regulations. (Id. ¶ 59.) The operating regulations prohibit a merchant from storing or retaining cardholder information. (Id. ¶¶ 22, 51 and 60.)

Sovereign cardholders used their Visa cards at BJ's, and BJ's retained the cardholders' information after Sovereign had approved the transactions, contrary to the operating regulations. (Id. ¶¶ 24 and 25.) Thereafter, third parties obtained the cardholder information to make unauthorized purchases. (Id. ¶ 27.) Sovereign paid for the fraudulent transactions and incurred other damages: the expense of *190 issuing new cards, the loss of fees and commissions while the cards were being replaced, and loss of good will. (Id. ¶¶ 30 and 32.)

The first two counts of the complaint are negligence claims, count I against BJ's and count II against Fifth Third. In count I, Sovereign alleges that "BJ's had a duty to exercise reasonable care in deleting or erasing cardholder information after a transaction had been approved and/or safeguard such information," (id. ¶ 34), breached that duty by failing to delete the information promptly after Sovereign had approved the transaction, (id. ¶ 37), and that as a result, the cardholder information was stolen, causing damage to Sovereign. (Id. ¶¶ 39 and 40.)

In count II, Sovereign alleges that "Fifth Third had a duty to exercise reasonable care in monitoring how BJ's processed transactions so as to ensure that BJ's complied with its duties to delete or erase Cardholder Information after a transaction had been approved and/or safeguard such information to prevent the unauthorized possession and/or misuse of the information" (id. ¶ 42), that it breached this duty by failing to adequately monitor BJ's (id. ¶¶ 43 and 44), and that as a result, the cardholder information was stolen, causing damage to Sovereign. (Id. ¶¶ 46 and 47.)

The next two counts are contract claims, count III against BJ's and count IV against Fifth Third. In count III, Sovereign alleges that it is a third-party beneficiary of BJ's merchant agreement with Fifth Third, that BJ's breached the agreement by failing to comply with the operating regulations requiring it not to retain or store cardholder information, and thereby damaged Sovereign. (Id. ¶¶ 50-56.)

In count IV, Sovereign alleges that it is a third-party beneficiary of the member agreement Fifth Third has with Visa, that Fifth Third breached the agreement by failing to insure that BJ's complied with the operating regulations requiring it not to retain or store cardholder information, and thereby damaged Sovereign. (Id. ¶¶ 58-65.)

The final two counts are for equitable indemnification, count V against BJ's and count VI against Fifth Third. In both counts, Sovereign alleges that it was "obligated to reimburse its Cardholders for losses" they suffered from the fraudulent use of their cardholder information, that "Sovereign did not actively participate in the events that led to the fraudulent use," that BJ's and Fifth Third did participate, and hence as between Sovereign and the two defendants, the defendants must indemnify Sovereign for its losses. (Id. ¶¶ 67-71 and 73-77.)

IV. Discussion.

A. BJ's Motion to Dismiss.

1. Breach-of-Contract Claim.

Acknowledging that it has no contract with BJ's, Plaintiff asserts its contract claim as a third-party beneficiary of the contracts between BJ's and Fifth Third.[3] BJ's credit- and debit-card contracts with Fifth Third require BJ's to comply with Visa regulations. Relevant here is the Visa regulation prohibiting a merchant from storing or retaining cardholder information, a regulation Sovereign alleges that BJ's failed to comply with when it stored and retained cardholder information.

In moving to dismiss, BJ's argues that Sovereign has no contract claim *191 against it because its contracts with Fifth Third specifically exclude third parties as beneficiaries of the agreements. As the relevant provisions read: "This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." BJ's argues that Ohio law rejects third-party-beneficiary claims when such a contractual exclusion is present, citing Hill v. Sonitrol of Southwestern Ohio, Inc., 36 Ohio St. 3d 36, 521 N.E.2d 780 (1988); CMC Elec. Co. v. J.D. Williamson Constr. Co., 1999 WL 1073685 (Ohio App.1999); and Matheny v. Ohio Bancorp., 1994 WL 738734 (Ohio App.1994).[4]

We agree with this argument. Hill is not directly on point but is relevant because it adopted the Restatement (Second) of Contracts § 302 (1981) as the law of Ohio for determining who qualifies as a third-party beneficiary of a contract. 521 N.E.2d at 784. While section 302 contemplates that a nonsignatory to a contract can be an intended beneficiary if certain conditions are met, it recognizes the right of the contracting parties to exclude third parties from invoking the benefits of their agreement. It begins "[u]nless otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intentions of the parties and ..." Restatement § 302(1). In the instant case, the promisor (BJ's) and the promisee (Fifth Third) "otherwise agreed." They included in their contracts a paragraph specifically providing that the contracts were not for the benefit of, and not intended to be enforced, by any third party. Hence, Plaintiff is not a third-party beneficiary of the contracts between BJ's and Fifth Third and cannot bring a breach-of-contract claim for BJ's alleged failure to follow the Visa regulations. See Matheny, supra, 1994 WL 738734, at *5 ("Section 302 of the Restatement clearly provides that one who might otherwise satisfy the definitional elements of an intended third-party beneficiary will not be treated under the law as such when it is "otherwise agreed between promisor and promisee." ").

In addition to Matheny and CMC Elec. Co., supra, 1999 WL 1073685, at *2, the other nonprecedential opinion from the Ohio Court of Appeals, other courts have also concluded that a third party cannot sue on a contract that affirmatively excludes third parties from the contract's benefits. See India.Com, Inc. v. Dalal, 412 F.3d 315, 321-22 (2d Cir.2005) (New York law); Riscorp, Inc. v. Norman, ___ *192 So.2d ___, ___, 2005 WL 628832, at *8 (Ala.2005); Hrushka v. State, 117 N.H. 1022, 381 A.2d 326, 327 (1977); Cities Service Co. v. Gulf Oil Corp., 797 P.2d 1009, 1011-12 (Okla.Civ.App.1990) (collecting cases and noting that contractual exclusion of third-party beneficiaries is the majority rule); Villanova, Ltd. v. Convergys, 2001 WL 868662, at *2 (E.D.Pa.2001) (interpreting Pennsylvania law); In re Gulf Oil/Cities Service Tender Offer Litigation, 725 F. Supp. 712, 731 (S.D.N.Y.1989) (Delaware law); Gannon v. Baldt Anchor and Chain, 459 F. Supp. 457, 459 (E.D.Pa.1978) (interpreting Pennsylvania law).

Plaintiff has cited three cases where the courts have not enforced an exclusion of third-party rights, but they are distinguishable. In State Farm Mut. Auto. Ins. Co. v. HHS Assocs., Inc., 1995 WL 739703 (E.D.Pa.), plaintiff State Farm, the buyer of real property, sued the defendant seller and a second defendant, an environmental-assessment company. The claim against the latter defendant was that it had breached a contract between itself and the seller by failing to accurately assess the environmental damage to the property. The court allowed the contract claim to proceed in the face of the exclusion, but in the circumstances of the case the only purpose the contract served was to benefit the plaintiff buyer (as also supported by deposition testimony). Additionally, as the court itself came close to acknowledging, its ruling bordered on dictum since the seller had assigned its rights under the contract to plaintiff State Farm in any event. 1995 WL 739703, at *4 n. 2. Here, in contrast, the merchant agreements had not been made for the sole benefit of Sovereign.

In Twin City Constr. Co. v. ITT Indus. Credit Co., 358 N.W.2d 716 (Minn.App.1984), the plaintiff construction company, at the behest of the defendant loan company, had given up significant rights as against the owner of the hotel that was being built (basically agreeing to complete construction without any recourse against the owner) so that the owner could obtain a loan from the defendant to complete the hotel. During construction, the defendant made progress payments directly to the plaintiff, but failed to make the last one, leading to the suit. The court ruled that under these circumstances the plaintiff could sue on the loan agreement, despite the exclusion of third-party rights. 358 N.W.2d at 718-19. Here, in contrast, Sovereign was not directly involved in the negotiation of the Visa merchant agreements between BJ's and Fifth Third nor did it surrender significant rights to have those agreements consummated.

In Versico, Inc. v. Engineered Fabrics Corp., 238 Ga.App. 837, 520 S.E.2d 505 (1999), the court ruled that the plaintiff owner of a building could sue the current owner of a roofing-system business for breach of warranty on work performed by the previous owner of the business. The contract for the sale of the assets of the business provided that the buyer would honor warranty claims on roofing products sold before the transfer of the business but excluded third-party rights. The court ruled that the plaintiff could bring its warranty claim as a third-party beneficiary of that contract despite the exclusion, reasoning that the specific provision dealing with the assumption of warranty claims prevailed over the general provision disclaiming third-party rights. 520 S.E.2d at 508-09. Versico is distinguishable because BJ's undertook no similar obligation of service on its main business of retail sales.

Finally, we are not impressed by Sovereign's argument that the exclusion can still be enforced, just not for the provisions of the merchant agreements Sovereign relies upon to sue. The exclusion of third-party *193 rights is for the entire agreement, not just for certain provisions. We will therefore dismiss the contract claim against BJ's.

2. The Negligence Claim.

a. BJ's Had a Duty of Care in Regard to Cardholder Information of Sovereign's Customers.

BJ's contends that Sovereign has failed to allege that BJ's owed it a duty, an essential element of a negligence claim, and hence has failed to state a claim for negligence. See Sharpe v. St. Luke's Hospital, 573 Pa. 90, 95, 821 A.2d 1215, 1219 (2003) ("A cause of action in negligence requires allegations that establish the breach of a legally recognized duty or obligation...."). In opposition, Sovereign argues that BJ's did have a duty.[5]

"The determination of whether a duty exists in a particular case involves the weighing of several discrete factors which include: (1) the relationship between the parties; (2) the social utility of the actor's conduct; (3) the nature of the risk imposed and foreseeability of the harm incurred; (4) the consequences of imposing a duty upon the actor; and (5) the overall public interest in the proposed solution." Bilt-Rite Contractors, Inc. v. Architectural Studio, 581 Pa. 454, 471, 866 A.2d 270, 281 (2005) (quoting Althaus ex rel. Althaus v. Cohen, 562 Pa. 547, 553, 756 A.2d 1166, 1169 (2000)).

Plaintiff maintains it has satisfied all of these requirements for imposing a duty on BJ's. First, there is a sufficient relationship between Plaintiff and BJ's because they both participate in the Visa network. BJ's as a merchant processes credit- and debit-card transactions for Sovereign as an issuing bank for the cards and, in the process, communicates directly with Sovereign before validating each transaction.[6]

Next, Plaintiff argues that the second and third elements are satisfied because "BJ's conduct enjoys no special social utility such that BJ's should be absolved of its negligence," (Doc. 8, Pl. Opp'n Br. at p. 8) and that "[t]his is especially true where the foreseeable consequence of BJ's breach of the duty of reasonable care would lead to fraudulent purchases..." (Id.) On these elements, Sovereign adds that the risks of BJ's violation of the operating regulation was foreseeable; retention of the cardholder information created the risk that the data would be stolen and used for fraudulent purchases, the very reason the regulation prohibits a merchant from storing the data.

As to the fourth element, Plaintiff argues that the consequences of imposing a duty of care on BJ's is fair and just because BJ's is in the best position to ensure that the cardholder information is not stolen from its computer files by simply complying with the regulation and deleting the data after Sovereign authorizes a transaction.

Finally, the fifth element is satisfied because the public interest favors holding *194 BJ's accountable for its negligence. If merchants ignored certain operating regulations, the Visa network would collapse as people refused to use an insecure payment system.

We agree with this analysis, for the most part. To begin with, Sovereign and BJ's have a sufficient relationship. A Sovereign cardholder uses the card at BJ's to buy a product. BJ's processes the transaction by electronically contacting Sovereign to approve it. The relationship is a direct one, with BJ's knowing the issuing bank before initiating or completing the transaction. See Bilt-Rite, supra, 581 Pa. at 481, 866 A.2d at 287 (architectural firm that had contracted to provide drawings and specifications for a school district had a sufficient relationship with the building contractor that had contracted with the school district to build the new school to be sued for negligence in creating the drawings and specifications when the firm knew the contractor would be relying on the drawings and specifications); Sharpe, supra, 573 Pa. at 96, 821 A.2d at 1219 (the plaintiff employee of a company which had contracted with the defendant hospital to collect and forward urine samples to a testing company had a sufficient relationship with the hospital to sue for negligent handling of her urine sample when she presented herself at the hospital for the testing and the hospital knew of the purpose of the testing).

Next, while the second element favors BJ's because its acceptance of credit and debit cards for retail transactions does have social utility in facilitating consumer transactions,[7] the third element favors imposition of a duty on BJ's because substantial harm may result from negligence in those transactions, and the harm is foreseeable. See Bilt-Rite, supra, 581 Pa. at 481, 866 A.2d at 287 ("on the question of the social utility of the conduct at issue, obviously design professional services play an important role in public and private planning. But, by the same token, given the important reliance placed upon such professional services, there is no reason to exempt such professionals from the tort consequences of a negligent failure to perform those services in a competent fashion."); Sharpe, supra, 573 Pa. at 98, 821 A.2d at 1220 ("while the Hospital's participation in the drug testing process certainly has social utility, the substantial harm deriving from inaccurate test results, which, in the context of Sharpe's employment-related screening, allegedly took the form of a termination of gainful employment, would be a foreseeable consequence of a breach of the duty of reasonable care.").

As to the fourth element, we agree with Plaintiff's argument that the consequences of imposing a duty of care on BJ's is fair and just because BJ's is in the best position to ensure that the cardholder information is not stolen from its computer files by simply complying with the regulation and deleting the data after Sovereign authorizes a transaction. Sharpe, supra, 573 Pa. at 98, 821 A.2d at 1220 (defendant hospital was in the best position to prevent negligent collection and handling of urine sample).

Finally, the fifth element is satisfied because the public interest favors holding BJ's accountable for its negligence. Noncash retail transactions are now common, as is computerized processing of those transactions. The regulation prohibiting *195 retention of cardholder information is crucial. As Plaintiff notes, if merchants ignored it, the Visa network, or any other credit and debit network, could fall into disuse if consumers decided it was not secure.

We are not persuaded by BJ's arguments to the contrary. Defendant first argues that the first element is not satisfied because in the Visa system while the parties are linked in a chain of contractual relationships, its own links in that system do not extend to Sovereign. It maintains it has no relationship at all with Sovereign; its only relationship in the network is a contractual one with Fifth Third. (Doc. 6, BJ's Reply Br. at p. 9.)

This position essentially argues the necessity of a contractual relationship, but in the negligence context, there is no need for a contractual relationship. Sharpe, supra, 573 Pa. at 97 n. 3, 821 A.2d at 1220 n. 3 ("Privity of contract, however, is not an essential prerequisite to the existence of a duty, as the law may operate under certain circumstances to impose a duty in favor of a third party against one operating under a contract, without reference to the terms of that contract."). As Sharpe shows, BJ's processing of Plaintiff's cardholders' transactions is a sufficient relationship for a negligence claim.

BJ's also argues that as a matter of public policy we should not recognize a negligence claim in these circumstances. Asserting "that the relationships between the members of the Visa system are based on contract," (doc. 6, Dft.'s Reply Br. at p. 10), it argues:

It is hornbook law that one of the goals of allowing and enforcing contracts is to let parties establish expectations with regard to their respective duties and liabilities and to avoid the uncertainty of tort-based damages. Enforcement of contractual relationships serves the important social policy of allowing businesses to predict their exposure and deal with it accordingly. To upset the expectations of contracting parties destroys the certainty that businesses need to operate efficiently. Sovereign should not be allowed to upset the expectations of the parties to the VISA system by injecting the uncertainty of tort law into the system. Moreover, by respecting the rights of parties to contractually manage their risks in the VISA system, it is likely that the system will continue to function which, undoubtedly, is in the public's interest.

(Id. at p. 11).

This argument is not persuasive. To begin with, Defendant does not cite the hornbook that presents this rule of law, or better yet, the cases on which the hornbook is based.[8] Additionally, Sovereign and BJ's are not in a contractual relationship, as BJ's itself maintains, and the rule Defendant proposes would apply only when the plaintiff has a contract with the defendant.

b. The Criminal Acts of Others Did Not Break the Causal Link Between BJ's Alleged Negligence and Plaintiff's Damages.

BJ's argues that Plaintiff has no negligence claim against it because the criminal acts of others that breached BJ's computer system intervened and broke the causal link between any negligent act of BJ's and any damage to Sovereign. (Doc. 4, Dft.'s Br. in Supp. at p. 10.) In support, BJ's cites Brezenski v. World Truck *196 Transfer, Inc., 755 A.2d 36 (Pa.Super.2000), and T.A. v. Allen, 447 Pa.Super. 302, 669 A.2d 360 (1995).

Both of these cases deal with a defendant's liability for the intentional tort or crime of third parties that causes physical harm to another. They analyzed the defendant's liability under the Restatement (Second) of Torts § 315 (1965). That section provides that there is no duty to protect a plaintiff from physical harm that might be inflicted by a third party unless there is: (1) a "special relationship" between the defendant and the plaintiff entitling the latter to protection; or (2) a "special relationship" between the defendant and the third party requiring the defendant to restrain the third party.

We agree with Plaintiff that these cases do not defeat its negligence claim. As section 315 indicates, it deals with a defendant's responsibility for physical harm to a plaintiff committed by a third person, a factual circumstance absent here. Moreover, Pennsylvania courts have applied another Restatement section, Restatement (Second) of Torts § 448 (1965), to permit recovery against a defendant for the criminal acts of another. See Civil Service Comm'n v. Vargo, 122 Pa.Commw. 642, 647-48, 553 A.2d 102, 104-05 (1989) (quoting Ford v. Jeffries, 474 Pa. 588, 597, 379 A.2d 111, 115 (1977)); Bryant v. Girard Bank, 358 Pa.Super. 335, 345-46, 517 A.2d 968, 973-74 (1986); DeJesus v. United States, 384 F. Supp. 2d 780, 800-01 (E.D.Pa.2005); Hayfield v. Home Depot U.S.A., Inc., 168 F. Supp. 2d 436, 461-62 (E.D.Pa.2001); City of Philadelphia v. Stepan Chemical Co., 544 F. Supp. 1135, 1153 (E.D.Pa.1982); Douglas W. Randall, Inc. v. AFA Protective Sys., Inc., 516 F. Supp. 1122, 1125 (E.D.Pa.1981).

Section 448 provides as follows:

The act of a third person in committing an intentional tort or crime is a superseding cause of harm to another resulting therefrom, although the actor's negligent conduct created a situation which afforded an opportunity to the third person to commit such a tort or crime, unless the actor at the time of his negligent conduct realized or should have realized the likelihood that such a situation might be created, and that a third person might avail himself of the opportunity to commit such a tort or crime.

Plaintiff argues that BJ's should have realized that its negligence in retaining customer information created a situation where third parties might avail themselves of the opportunity to steal cardholder information. Hence, the criminal acts of the third parties did not break the chain of causation. We agree that Plaintiff should be allowed to proceed on this theory and that BJ's lack-of-causation argument should be rejected.

c. The Gist of the Action Doctrine.

BJ's also argues that Pennsylvania's "gist of the action" doctrine bars Plaintiff's negligence claim. (Doc. 4, Dft.'s Br. in Supp. at p. 8.) The gist of the action doctrine bars a tort claim when the gist of the claim sounds in contract rather than in tort. See Quorum Health Resources, Inc. v. Carbon-Schuylkill Community Hosp., Inc., 49 F. Supp. 2d 430, 432 (E.D.Pa.1999); Sunquest Info. Sys., Inc. v. Dean Witter Reynolds, Inc., 40 F. Supp. 2d 644, 651 (W.D.Pa.1999).

We reject BJ's argument because the gist of the action doctrine only applies when the parties have a contractual relationship. See eToll, Inc. v. Elias/Savion Advertising, Inc., 811 A.2d 10, 14 (Pa.Super.2002) ("To permit a promisee to sue his promisor in tort for breaches of contract inter se would erode the usual rules of contractual recovery and inject *197 confusion into our well-settled forms of actions.") (quoting Bash v. Bell Telephone Co., 411 Pa.Super. 347, 356, 601 A.2d 825, 829 (1992)) (case quoted in Bash omitted); see also McDole v. Bell Telephone Co., 441 Pa.Super. 88, 92, 656 A.2d 933, 935 (1995) (rejecting use of the gist of the action doctrine to bar a negligence claim when the contract had expired before the cause of action accrued). Here, we have decided that Sovereign has no contractual relationship with BJ's. Hence, the gist of the action doctrine does not apply to bar the negligence claim.

Citing ACME-Hardesty Co. v. Wenger, 2003 WL 1847461, at *4 (Phila.Ct.Com.Pl.2003), BJ's nonetheless argues that the gist of the action doctrine bars a negligence claim based on alleged breach of duties imposed by contract, even if the court decides that Plaintiff has no contractual relationship with the defendant.

We disagree. BJ's has misconstrued ACME-Hardesty. In that case, the plaintiffs sued after losing property in a warehouse fire. Defendant Honeywell was responsible for monitoring the warehouse's fire- and burglar-alarm systems, and the plaintiffs alleged the system was inadequate, leading to their losses. Honeywell brought into the suit as additional defendants the warehouse owner's insurance company and its insurance broker, alleging that they had been negligent in the amount of coverage provided and in breaching a contract with the warehouse owner to provide that coverage, with Honeywell asserting third-party-beneficiary status under that contract.[9]

On the preliminary objections of the additional defendants, the court decided that Honeywell had no negligence claim against them for two reasons. First, the court considered a straightforward negligence claim, and rejected it because the law imposed no duty on the additional defendants "as a matter of social policy" ... "to undertake risk assessments and to provide insurance coverage to members of the public or their indemnitees with whom they have no other relationship." 2003 WL 1847461, at *3 (footnote omitted). Then, since no "social policy" imposed a duty for which the additional defendants could be held accountable in negligence, the court considered whether they could be held liable for negligent breach of the alleged contract, and rejected that claim as well because the gist of the action doctrine bars claims for negligent breach of contract. Id. at *4. The court then dismissed the breach-of-contract claim, rejecting Honeywell's position that it was a third-party beneficiary of the contract.

Thus, the court did not, as BJ's argues, dismiss the negligence claim on the ground that the gist of the action doctrine bars such a claim when based on a breach of contractual duties, even after the contract claim is no longer in the case. Instead, it considered and rejected a negligence claim based on whether the additional defendants had breached a duty imposed by law and only then used the gist of the action doctrine as an additional reason to bar a negligence claim, on the assumption that the claim was based on a negligent breach of contractual duties.

3. The Equitable-Indemnification Claim.

Plaintiff has made an equitable-indemnification claim against BJ's for the cost of reimbursing cardholders for the *198 fraudulent use of their information. BJ's moves to dismiss this claim by arguing that the only basis for the claim would be that Sovereign's liability is secondary to BJ's, but Sovereign has not made, and cannot make, any allegations to establish its secondary liability.

When one party must pay damages to another based on some legal obligation, common-law (equitable) indemnity permits that party to recover its payment from another person if the former's liability is "secondary" to the "primary" liability of the latter. Sirianni v. Nugent Bros., Inc., 509 Pa. 564, 569-70, 506 A.2d 868, 870-71 (1986). Secondary liability is different in degree and kind from primary liability. Id. at 570, 506 A.2d at 871. Secondary liability is "constructive only, being based on some legal relation between the parties, or arising from some positive rule of common or statutory law or because of a failure to discover or correct a defect or remedy a dangerous condition caused by the act of the one primarily responsible." Id., 506 A.2d at 871.

Plaintiff bases its claim on an obligation imposed by a positive rule of statutory law, contending that it had to pay for the unauthorized use of the information under the Truth in Lending Act because a cardholder has little or no liability for unauthorized charges. See 15 U.S.C. § 1643(a), (d) (setting cardholder liability at a maximum of $50.00 for unauthorized charges). Plaintiff also relies on Presta Oil, Inc. v. Van Waters & Rogers Corp., 276 F. Supp. 2d 1128, 1135 (D.Kan.2003), in asserting that the Truth in Lending Act requires the issuing bank to credit the cardholder for any unauthorized charges. It also points out that it did not actively participate in the events that led to the unauthorized charges. Instead, BJ's conduct in retaining cardholder information allowed those charges to happen.

We will dismiss this claim. As BJ's contends in its reply brief, the Truth in Lending Act does not impose on issuing banks the obligation to pay for unauthorized credit-card use. Instead, section 1643 merely relieves cardholders of any obligation for unauthorized use of their cards in excess of fifty dollars. Presta Oil, supra, is not to the contrary. That case did not say that the act imposed on issuing banks the obligation to pay for unauthorized credit-card use, only that the act put "the risk of loss" on such banks, a reasonable interpretation of legislation that relieved cardholders of responsibility in excess of fifty dollars. Since Sovereign's theory of liability fails (no positive rule of statutory law imposed any duty on Sovereign), it has no secondary liability, and its equitable-indemnification claim fails.

B. Fifth Third's Motion to Dismiss.

1. Plaintiff Has a Valid Contract Claim Against Fifth Third.

For its breach-of-contract claim against Fifth Third, Plaintiff claims to be a third-party beneficiary of Fifth Third's member agreement with Visa. That contract requires Fifth Third to assure that its merchants will comply with Visa's operating regulations, which Fifth Third allegedly failed to do since BJ's retained customer information in violation of the regulations.

Fifth Third argues that Sovereign's third-party-beneficiary claim fails because under Pennsylvania case law Sovereign is not a third-party beneficiary of the contract between Fifth Third and Visa.[10]

Pennsylvania has adopted the Restatement (Second) of Contracts § 302 (1981) for determining third-party-beneficiary *199 status. In Scarpitti v. Weborg, 530 Pa. 366, 609 A.2d 147 (1992), the Pennsylvania Supreme Court summarized Pennsylvania third-party-beneficiary law as follows:

[A] party becomes a third party beneficiary only where both parties to the contract express an intention to benefit the third party in the contract itself, Spires, supra, unless, the circumstances are so compelling that recognition of the beneficiary's right is appropriate to effectuate the intention of the parties, and the performance satisfies an obligation of the promisee to pay money to the beneficiary or the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. Guy [v. Liederbach, 501 Pa. 47, 459 A.2d 744 (1983)], supra.

Id. at 372-73, 609 A.2d at 150-51 (emphasis in original).[11]

As indicated, there are two tests for third-party-beneficiary status. As the citation to Spires v. Hanover Fire Ins. Co., 364 Pa. 52, 70 A.2d 828 (1950), shows, the first one requires that the parties to the agreement indicate in the agreement itself that the purported beneficiary is a third-party beneficiary. The second test does not require an affirmative recognition of the purported beneficiary in the contract itself but imposes two requirements. First, the circumstances must be so compelling that recognition of the beneficiary's right is appropriate to effectuate the intention of the parties. Second, (1) the performance satisfies an obligation of the promisee to pay money to the beneficiary or (2) the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. Elaborating on this second test, the supreme court stated:

The first part of the test sets forth a standing requirement which leaves discretion with the court to determine whether recognition of third party beneficiary status would be appropriate. The second part defines the two types of claimants who may be intended as third party beneficiaries. If a party satisfies both parts of the test, a claim may be asserted under the contract.

Scarpitti, supra, 530 Pa. at 371, 609 A.2d at 150.

In resolving Fifth Third's motion to dismiss, we will start with Plaintiff's exposition of its third-party-beneficiary claim in its brief in opposition to Fifth Third's motion. Sovereign relies on the second test to establish its status. On the first part of this test, the standing requirement, Plaintiff relies on the provision of the member agreement between Visa and Fifth Third requiring Fifth Third to ensure that its merchants will abide by Visa operating regulations, including the regulation that merchants not retain customer information. Sovereign maintains that the purpose of this contractual obligation on Fifth Third's part "is to ensure the continued functionality and integrity of the Visa network and the transactions that occur within that network" so that "catastrophic damages [to] other participants" is prevented and "the network [is] more attractive *200 to new participants ..." (Doc. 9, Pl.'s Opp'n Br. at pp. 12, 14-15.) As the argument continues, this purpose means that the promisor (Fifth Third) and the promisee (Visa) contemplated a third-party relationship with issuing banks like Sovereign whose customers used their credit or debit cards at merchants like BJ's. It follows that the first part of the second test is satisfied since it would be appropriate to recognize Sovereign's third-party-beneficiary status.

As to the second part of the test, Plaintiff relies on that prong evaluating whether the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance, contending that Visa, the promisee, did intend to give Sovereign the benefit of Fifth Third's performance as promisor. (Doc. 9, Pl.'s Opp'n Br. at p. 15.)[12]

Plaintiff likens its claim to the one in Scarpitti, supra, where the Pennsylvania Supreme Court recognized the right of plaintiff new-home buyers to sue as third-party beneficiaries of a contract between the defendant architect and the developer of the subdivision where the new homes would be built. The architect had agreed with the developer to review the construction plans for the new homes to ensure that they complied with the subdivision's restrictions. He rejected the plaintiffs' plans as violative of a restriction on three-car garages, required them to modify their plans accordingly, but allowed other homeowners to build with three-car garages.

In deciding that the plaintiff home buyers were third-party beneficiaries of the contract between the developer and the architect, the supreme court reasoned as follows. First, it determined that the "obvious purpose" of the "underlying contract" between the architect as promisor and the developer as promisee "was to make the lots more attractive to prospective purchasers by assuring that other homeowners in the subdivision would be required to abide by the recorded subdivision restrictions." 530 Pa. at 373, 609 A.2d at 151. The court opined: "It is the homeowners who have the greatest interest in uniform enforcement of restrictions and it is the homeowners who were benefitted by the establishment of a vehicle to enforce the restrictions." Id., 609 A.2d at 151. It followed that the homeowners were reasonable in believing that the promise to enforce the subdivision restrictions "manifest [ed] an intention to confer a right on them," id., 609 A.2d at 151, and from there for the court to conclude that "recognition of a right to uniform enforcement of the deed restrictions in [the plaintiffs] is appropriate to effectuate the intention of the parties," id., 609 A.2d at 151, thereby satisfying the standing requirement of the second test for third-party-beneficiary status.

As to the second part of the test, the supreme court found that part satisfied by the prong dealing with whether the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. The court found that the promisee developer did intend to give this "limited class" the benefit of the architect's performance. (Indeed, the court found that the architect intended to benefit them as well.) Closing, the court noted that no other purpose for the contract had been advanced. Id. at 373-74, 609 A.2d at 151.

Sovereign says its own case is just like Scarpitti. The underlying agreement is between a promisor, Fifth Third, and its promisee, Visa, to ensure that Fifth *201 Third's merchants will abide by the operating regulations (specifically the operating regulation forbidding merchants from retaining customer information). One can glean from the circumstances that the purpose of the agreement was to make the Visa network safe for issuing banks, either those already in the network or those contemplating joining it, by assuring them that their customer information will only be in a merchant's possession long enough to make a transaction. Thus, the third-party-beneficiary relationship for issuing banks was within the contemplation of Visa and Fifth Third at the time of contracting. Finally, since Visa intended to give issuing banks like Sovereign the benefit of Fifth Third's performance, Sovereign's third-party-beneficiary status under the member's agreement is established and Sovereign can sue for breach of that contract.

In moving to dismiss, Fifth Third argues that Plaintiff ignores three fatal defects in its third-party-beneficiary claim: (1) the member agreement does not express any intention to benefit Sovereign; (2) the "intentions of the parties to the contract, as disclosed by its terms, can be effectuated without recognition of Sovereign's alleged third-party-beneficiary rights"; and (3) the performance of the contract would not satisfy an obligation of the promisee, VISA, to pay money to Sovereign. (Doc. 8, Def.'s Br. in Supp. p. 5.)

We reject these arguments. First, the member agreement does not have to express any specific intention to benefit Sovereign as long as Sovereign satisfies the second test for third-party-beneficiary status. Second, a third party's rights under a contract are not determined by whether the "intentions of the parties to the contract, as disclosed by its terms, can be effectuated without recognition of Sovereign's alleged third-party-beneficiary rights." Further, as noted above, the Pennsylvania Supreme Court looks beyond the contract to determine the parties' purpose. Finally, Sovereign does not rely upon an obligation of the promisee, VISA, to pay money to Sovereign but on the intent of Visa, the promisee, to give Sovereign the benefit of Fifth Third's performance as promisor.

Fifth Third has also chain-cited a number of cases which it describes as having rejected claims by participants in the Visa system that they are third-party beneficiaries of the contracts between other participants in the system: Schwartz v. Visa Int'l Corp., 2003 WL 1870370 (Cal.Super.2003) (claim of unfair practices by Visa and MasterCard concerning currency-conversion charges), rev'd, Schwartz v. Visa Int'l Serv. Ass'n, 132 Cal. App. 4th 1452, 34 Cal. Rptr. 3d 449 (2005); Owner-Operator Indep. Drivers Ass'n, Inc. v. Concord EFS, Inc., 59 S.W.3d 63 (Tenn.2001)(rejecting cardholders' claim of being third-party beneficiaries of contracts between acquiring banks and merchants to challenge merchants' surcharges on credit-card fuel purchases); Cherry v. Bank of America, 90 Fed.Appx. 246, 247 (9th Cir.2004) (nonprecedential) (under Arizona law airline credit-card holder was not a third-party beneficiary of an agreement between the issuing bank and the airline to lower interest rates on the card after the cardholder received his card); American Express Travel Related Services Co. v. American Fine Art and Frame Co., 2004 WL 1144103 (N.D.Tex.2004) (a cardholder is not a third-party beneficiary of the agreement between the association creating the credit-card network and a merchant for his claim disputing a charge where "the agreement merely sets forth a procedure for resolving disputes over payment to the merchant"); Nova Info. Sys., Inc. v. Greenwich Ins. Co., 365 F.3d 996 (11th Cir.2004) (the entity that processes credit-card transactions as a subcontractor of an *202 acquiring bank is not a third-party beneficiary of a suretyship agreement between the merchant cruise line and its insurer guaranteeing reimbursement to cruise-line customers if the line failed to perform); Leatherwood v. Cardservice Int'l, Inc., 885 So. 2d 997 (Fla.App.2004) (venue of a suit brought by the owner of a corporation was proper in Florida, rejecting claim that he was a third-party beneficiary of a contract between the corporation and a credit-card processor containing a forum-selection clause requiring suits between the corporation and the processor to be brought in California).

Broadly speaking, Fifth Third may have correctly described these cases' holdings, but as Plaintiff points out none of them deal with the factual situation at hand. We have reviewed these cases and find them unhelpful for that reason. Fifth Third has not detailed why these cases support its contention that Sovereign is not a third-party beneficiary of its member agreement with Visa, so we are not inclined to distinguish them separately. However, we will briefly mention why Owner-Operator, supra, does not persuade us.

In Owner-Operator, the plaintiff tractor-trailer drivers filed suit contesting surcharges imposed by merchants on diesel-fuel purchases made with Visa and MasterCard credit cards. The cardholders claimed to be third-party beneficiaries of contracts between the acquiring banks and the merchants selling the fuel that required the merchants to abide by Visa and MasterCard regulations. Those regulations prohibited surcharges on credit-card purchases. The Tennessee Supreme Court rejected the claim, in part, because under Restatement section 302(1)(b) it decided that the prohibition on surcharges was not intended to benefit cardholders but to benefit the acquiring bank by encouraging card usage, thereby maximizing its profits. 59 S.W.3d at 73.

Owner-Operator offers no guidance here because the regulation at issue is materially different. When an acquiring bank requires its merchants not to surcharge credit-card purchases, it is a reasonable conclusion that the bank intends to benefit only itself. Further, under Scarpitti, which does take into account the reaction of the potential third-party beneficiaries, the average cardholder probably does not even think about a no-surcharge provision. On the other hand, a requirement concerning the security of the basic transaction in a credit-card network would be intended to benefit more than just the acquiring bank,[13] and an issuing bank would consider it of the upmost importance that a merchant be required to safeguard cardholder information.

In its reply brief, Fifth Third argues that Plaintiff is attempting to establish third-party-beneficiary status merely because it relied on BJ's promise to comply with the regulation and because it benefitted, incidentally, from it. (Doc. 10, Def.'s Reply Br. p. 3.) We disagree. Sovereign has relied on the purpose of the regulation, as Scarpitti permits.

In its reply brief, Fifth Third also argues that if Visa and Fifth Third had intended to make Sovereign a third-party beneficiary of their contract, they could easily have done so in the contract. This argument conflicts with Scarpitti, supra, which permits a party to claim third-party-beneficiary status, even if it has not been *203 named specifically in the contract, as long as it satisfies Restatement (Second) of Contracts § 302.

In conclusion, we agree with Sovereign that it is a third-party beneficiary of the membership agreement between Visa and Fifth Third. As Sovereign asserts, the underlying agreement between the promisor, Fifth Third, and its promisee, Visa, required Fifth Third to ensure that its merchants would abide by Visa's operating regulations (specifically the operating regulation forbidding merchants from retaining customer information). The purpose of the agreement was to make the Visa network safe for issuing banks, either those already in the network or those contemplating joining it, by assuring them that their customer information will only be in a merchant's possession long enough to make a transaction. Thus, the third-party-beneficiary relationship for issuing banks was within the contemplation of Visa and Fifth Third at the time of contracting. Further, since Visa intended to give issuing banks like Sovereign the benefit of Fifth Third's performance, Sovereign has third-party-beneficiary status under Fifth Third's member agreements with Visa.

We therefore deny the motion to dismiss Sovereign's contract claim against Fifth Third.[14]

2. The Aikens Economic Loss Doctrine Bars the Negligence Claim.

Fifth Third has moved to dismiss Plaintiff's negligence claim on the grounds that Fifth Third owed Sovereign no duty of reasonable care, an essential element of a negligence claim, and that the economic loss doctrine bars Sovereign's negligence claim. In connection with the latter argument, Defendant points out that Sovereign is seeking damages for purely economic losses, principally the cost of replacing its customers' cards and reimbursing them for unauthorized purchases on their cards. Defendant maintains that when there has been no physical harm to person or property, recovery of economic losses alone is barred. We need not address the first argument; we agree with the second.

Fifth Third's argument is based on a line of cases beginning with Aikens v. Baltimore & Ohio RR. Co., 348 Pa.Super. 17, 501 A.2d 277, 278 (1985). In Aikens, the Pennsylvania Superior Court held that workers who lost wages because a train derailment damaged the factory where they worked could not bring a negligence claim for their "purely economic loss[es]," 348 Pa.Super. at 20, 501 A.2d at 278, unless there was also physical injury, either to the person or property. The court acknowledged the roots of the rule in Robins Dry Dock & Repair Co. v. Flint, 275 U.S. 303, 48 S. Ct. 134, 72 L. Ed. 290 (1927), and also adopted Restatement (Second) of Torts § 766C (1979) as the general rule.[15]*204 The superior court offered two rationales for the rule. First, the putative tortfeasor could not foresee the harm: "the negligent actor has no knowledge of the contract or prospective relation and thus has no reason to foresee any harm to the plaintiff's interest." 348 Pa.Super. at 21, 501 A.2d at 279 (citations omitted). Second, public policy dictated a limitation on the right of recovery in negligence for economic losses: "To allow a cause of action for negligent cause of purely economic loss would be to open the door to every person in the economic chain of the negligent person or business to bring a cause of action. Such an outstanding burden is clearly inappropriate and a danger to our economic system." Id. at 21, 501 A.2d at 279.

Aikens's economic loss doctrine has been followed in subsequent cases to bar negligence claims seeking recovery for "economic damages" or "losses" unless there has also been physical injury either to a person or property. See Spivack v. Berks Ridge Corp., 402 Pa.Super. 73, 78, 586 A.2d 402, 405 (1990); Duquesne Light Co. v. Pennsylvania American Water Co., 850 A.2d 701 (Pa.Super.2004); General Public Utilities v. Glass Kitchens of Lancaster, Inc., 374 Pa.Super. 203, 542 A.2d 567 (1988); Margolis v. Jackson, 375 Pa.Super. 182, 543 A.2d 1238 (1988); Moore v. Pavex, Inc., 356 Pa.Super. 50, 514 A.2d 137 (1986); Adams v. Copper Beach Townhome Communities, L.P., 816 A.2d 301, 305 (Pa.Super.2003) ("The Economic Loss Doctrine provides that no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage.").

In opposition, Plaintiff makes two arguments. First, the economic loss doctrine does not apply because it did not suffer economic losses; instead it suffered a loss of "real and concrete" property, its money. We reject this argument because in the context in which Plaintiff lost its money, payment for replacement cards and reimbursement for unauthorized charges, it did suffer purely economic losses. See Rose Fuel Oil & Heating Co. v. Kia Motors of America, Inc., 2004 WL 1202901, at *2 (E.D.Pa.) (citing Teledyne Technologies, Inc. v. Freedom Forge Corp., 2002 WL 748898 (Phila.Ct.Com.Pl.2002)).

Plaintiff' second argument is that the Aikens economic loss rule only applies when the damages are not foreseeable and here Fifth Third could easily foresee that if its merchant does not guard or delete customer information on the cards, third parties might steal the information.

We reject this argument as well. As noted above, Aikens did say that one reason for the economic loss doctrine was the lack of foreseeability of the plaintiff's damages. 348 Pa.Super. at 21, 501 A.2d at 279. But it also decided as a matter of public policy that there would be no right of recovery in negligence for economic losses to prevent anyone "in the economic chain" to sue so that the "economic system" would not be burdened. Id. at 21, 501 A.2d at 279. Some cases have cited the lack of foreseeability in applying the rule, Moore, supra, 356 Pa.Super. at 54, 514 A.2d at 139, but others have said the public-policy argument is sufficient. Adams, supra, 816 A.2d at 305; Margolis, supra, 375 Pa.Super. at 185-86, 543 A.2d at 1240; see also Hemispherx Biopharma, *205 Inc. v. Asensio, 1999 WL 144109, at *13 (E.D.Pa.). We agree that the latter argument is an adequate ground for applying the economic loss doctrine.

Plaintiff has also cited Bilt-Rite Contractors, Inc. v. Architectural Studio, 581 Pa. 454, 866 A.2d 270 (2005), in support of its second argument. However, that case is distinguishable. In Bilt-Rite, the Pennsylvania Supreme Court held that Restatement (Second) of Torts § 552 (1977) applied to professionals like architects, thus allowing the plaintiff construction company there to sue for the architect's negligent misrepresentations that imposed economic losses on the plaintiff by increasing its costs for constructing a school. One reason the supreme court adopted § 552 was that the architect knew that its plans would be used by construction companies on the project and hence any injury was foreseeable.

In allowing the case to proceed, addressing the economic loss doctrine for the first time, the court did reject the application of the doctrine but only for a claim of negligent misrepresentation. 866 A.2d at 288 ("Thus, we hold that the economic loss rule does not apply to claims of negligent misrepresentation sounding under Section 552."); see also Samuel Grossi & Sons, Inc. v. United States Fid. & Guar. Co., 2005 WL 1522043, at *6 n. 2 (Phila.Ct.Com.Pl.2005) (applying the economic loss doctrine to bar a negligence claim arising from a construction dispute and distinguishing Bilt-Rite because it was a negligent-misrepresentation case). Further, the state superior court has applied the doctrine in a number of cases dealing with other types of negligence claims. See Aikens, supra, 348 Pa.Super. 17, 501 A.2d 277; Spivack, supra, 402 Pa.Super. 73, 586 A.2d 402; Adams, supra, 816 A.2d 301; Duquesne Light Co., supra, 850 A.2d 701; General Public Utilities, supra, 374 Pa.Super. 203, 542 A.2d 567; Margolis, supra, 375 Pa.Super. 182, 543 A.2d 1238; Moore, supra, 356 Pa.Super. 50, 514 A.2d 137. We will therefore apply the economic loss doctrine to bar Sovereign's negligence claim.

3. Sovereign Has No Equitable-Indemnification Claim Against Fifth Third.

As it did against BJ's, Plaintiff has made an equitable-indemnification claim against Fifth Third for the cost of reimbursing cardholders for the fraudulent use of their information. Fifth Third moves to dismiss this claim on a number of grounds, but we can grant the motion on the same reasoning we employed to dismiss the claim against BJ's.

As noted above, one party can obtain equitable indemnity from another if the former's liability is "secondary" to the "primary" liability of the latter. Sirianni v. Nugent Bros., Inc., 509 Pa. 564, 569-70, 506 A.2d 868, 870-71 (1986). Secondary liability is "constructive only, being based on some legal relation between the parties, or arising from some positive rule of common or statutory law or because of a failure to discover or correct a defect or remedy a dangerous condition caused by the act of the one primarily responsible." Id., 506 A.2d at 871.

Plaintiff bases its claim on an obligation imposed by a positive rule of statutory law, contending that it had to pay for the unauthorized use of the information under the Truth in Lending Act because a cardholder has little or no liability for unauthorized charges. See 15 U.S.C. § 1643(a), (d). Plaintiff also relies on Presta Oil, Inc. v. Van Waters & Rogers Corp., 276 F. Supp. 2d 1128, 1135 (D.Kan.2003), in asserting that the Truth in Lending Act requires the issuing bank to credit the cardholder for any unauthorized charges.

*206 However, as we noted above, the Truth in Lending Act does not impose on issuing banks the obligation to pay for unauthorized credit-card use. Instead, section 1643 merely relieves cardholders of any obligation for unauthorized use of their cards in excess of fifty dollars. Presta Oil, supra, is not to the contrary. That case did not say that the act imposed on issuing banks the obligation to pay for unauthorized credit-card use, only that the act put "the risk of loss" on such banks. Since Sovereign's theory of liability fails (no positive rule of statutory law imposed any duty on Sovereign), it has no secondary liability, and its equitable-indemnification claim against Fifth Third fails.

V. Conclusion.

Based on the forgoing, only the negligence claim survives against BJ's and the other two claims, for equitable indemnification and unjust enrichment, will be dismissed. The contract claim against Fifth Third will survive but the remaining claims, for negligence and equitable indemnification, will be dismissed.

We will issue an appropriate order.

ORDER

AND NOW, this 18th day of October, 2005, it is ordered that:

1. The motion (doc. 3) of defendant BJ's to dismiss the complaint against it is granted in part. The contract claim (count III) and the equitable-indemnification claim (count V) are hereby dismissed. The motion to dismiss the negligence claim (count I) is denied.

2. The motion (doc. 7) of defendant Fifth Third Bank to dismiss the complaint against it is granted in part. The negligence claim (count II) and the equitable-indemnification claim (count VI) are hereby dismissed. The motion to dismiss the contract claim (count IV) is denied.

NOTES

[1] As Fifth Third Bank Corp. notes, Sovereign probably intended to sue Fifth Third Bank, but Defendant does not seek to substitute the bank as the proper defendant at this time.

[2] Pennsylvania State Employees Credit Union also had customer bank-card numbers stolen and has filed a similar lawsuit against BJ's and Fifth Third Bank, Pennsylvania State Employees Credit Union v. Fifth Third Bank, 1:CV-04-1554 (M.D.Pa.) (Caldwell, J.). Many of the issues are similar.

[3] The complaint alleges only one agreement between BJ's and Fifth Third, but BJ's exhibits establish there are two, one for credit transactions and one for debit transactions.

[4] The agreements provide that they shall be "governed, construed and enforced" under Ohio law. In a diversity case, a federal court applies the law of the state where it sits, including its choice-of-law rules. J.C. Penney Life Ins. Co. v. Pilosi, 393 F.3d 356, 360 (3d Cir.2004). Generally, Pennsylvania will enforce choice-of-law provisions in contracts. Echols v. Pelullo, 377 F.3d 272, 275 (3d Cir.2004). Hence, we apply Ohio law to the contract claim.

Sovereign argues that Pennsylvania law applies, but we disagree. Sovereign reasons that there is no "true conflict" between the law of Pennsylvania and the law of Ohio and that in these circumstances, Pennsylvania, the forum state, applies its own law to the contract, citing Permenter v. Crown Cork & Seal Co., 38 F. Supp. 2d 372, 376 (E.D.Pa.1999). However, that case is distinguishable. Permenter did not deal with a contractual choice-of-law provision. Thus, while we agree with Plaintiff that the third-party-beneficiary law of Pennsylvania and Ohio is the same, this does not mean that Pennsylvania choice-of-law rules lead to the application of Pennsylvania law. At most, it might mean that no choice of law need be made (although we have decided that Ohio law applies).

[5] In arguing the merits of the negligence claim, both parties rely on Pennsylvania law, although BJ's also contends that the outcome would be the same under the law of Ohio and Massachusetts, the other jurisdictions that might have an interest in the litigation.

[6] On this element, Plaintiff also cites cases dealing with securities claims, asserting that the Visa regulations establish a standard of care, in the same way rules governing stockbrokers' conduct establish a standard of care in securities cases, citing among others, Scott v. Dime Sav. Bank, 886 F. Supp. 1073, 1080-81 (S.D.N.Y.1995); and Merrill Lynch, Pierce, Fenner & Smith, Inc. v. Cheng, 697 F. Supp. 1224, 1227 (D.D.C.1988). We fail to see the relevance of these cases to determining whether a duty exists, as opposed to determining the standard of care once a duty is recognized.

[7] Sovereign seems to be saying that the conduct to be examined is BJ's retention of the cardholder information, but in our view, the conduct we must examine is BJ's acceptance of Sovereign's cards.

[8] Although we note that a similar rationale appears in cases using the economic loss doctrine to bar a negligence claim for a defective product. See East River Steamship Corp. v. Transamerica Delaval Inc., 476 U.S. 858, 106 S. Ct. 2295, 90 L. Ed. 2d 865 (1986).

[9] The owner was also a defendant and had filed a separate suit against its insurer and broker on the same claims.

[10] Both parties rely on Pennsylvania third-party-beneficiary law.

[11] This summary incorporates the substance of Section 302(1), which reads as follows:

(1) Unless otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intentions of the parties and either

(a) the performance of the promise will satisfy an obligation of the promisee to pay money to the beneficiary; or

(b) the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance.

[12] In fact, Sovereign argues that Fifth Third also intended to give it the benefit of its performance, but we need not address that argument.

[13] While the acquiring bank in Owner-Operator was able to proffer an alternative purpose for the regulation challenged there, Fifth Third has not offered an alternative explanation of the purpose of the requirement that a merchant not retain cardholder information nor has it said who benefits from this provision, other than the issuing bank.

[14] We note that in responding to Sovereign's argument that if it is denied third-party-beneficiary status, no one would be able to enforce the operating regulations, Fifth Third points to an operating regulation conferring enforcement authority on Visa for violations of the regulations. (Doc. 10, Def.'s Reply Br. Ex 1.) At least one court has denied third-party-beneficiary status based in part on enforcement procedures found in the contract. See Register.Com, Inc. v. Verio, Inc., 356 F.3d 393 (2d Cir.2004). We do not consider it here because Fifth Third has not directly argued that Sovereign's third-party-beneficiary status is defeated by the operating regulations' dispute-resolution procedure, it was raised for the first time in the reply brief, and it does not appear that the entire procedure is before us.

[15] Section 766C, captioned "Negligent Interference with Contract or Prospective Contractual Relation," reads as follows:

One is not liable to another for pecuniary harm not deriving from physical harm to the other, if that harm results from the actor's negligently

(a) causing a third person not to perform a contract with the other, or

(b) interfering with the other's performance of his contract or making the performance more expensive or burdensome, or

(c) interfering with the other's acquiring a contractual relation with a third person.