Case: 19-20430 Document: 00515945903 Page: 1 Date Filed: 07/21/2021
United States Court of Appeals
for the Fifth Circuit United States Court of Appeals
Fifth Circuit
FILED
July 21, 2021
No. 19-20430 Lyle W. Cayce
Clerk
Landry’s, Incorporated, as successor in interest to Landry’s
Management, LP,
Plaintiff—Appellant,
versus
The Insurance Company of the State of Pennsylvania,
Defendant—Appellee.
Appeal from the United States District Court
for the Southern District of Texas
USDC No. 4:18-CV-2679
Before Smith and Oldham, Circuit Judges.*
Andrew S. Oldham, Circuit Judge:
The question presented is whether the Insurance Company of the
State of Pennsylvania (“ICSOP”) has a duty to defend its insured, Landry’s,
in data-breach litigation. At summary judgment, the district court said no.
We disagree and reverse.
*
Judge Ho participated in oral argument and then determined that he is recused.
Accordingly, this matter is decided by a quorum. See 28 U.S.C. § 46(d).
Case: 19-20430 Document: 00515945903 Page: 2 Date Filed: 07/21/2021
No. 19-20430
I.
Landry’s is a Houston-based company that operates retail properties
like restaurants, hotels, and casinos. Paymentech, LLC—a branch of
JPMorgan Chase Bank—processes Visa and MasterCard payments to those
properties. A typical payment process follows the same steps: (1) The
customer presents his card to a Landry’s property; (2) a point-of-sale system
at Landry’s sends the credit-card information to Paymentech;
(3) Paymentech obtains an authorization from Visa or MasterCard and from
the bank that issued the customer’s credit card; and (4) the funds are
collected and sent to JPMorgan Chase.
On December 2, 2015, Paymentech 1 discovered credit-card problems
at some Landry’s properties. Paymentech began an investigation, which
uncovered a data breach that occurred across 14 Landry’s locations between
May 2014 and December 2015. Landry’s then initiated its own investigation,
and it discovered that the data breach involved the unauthorized installation
of a program on its payment-processing devices. The program was designed
to search for data from credit cards’ magnetic strips—including the
cardholder’s name, card number, expiration date, and internal verification
code—as the information was being routed through the payment-processing
systems. Over approximately a year and a half, the program retrieved
personal information from millions of customers’ credit cards. And at least
some of that credit-card information was used to make unauthorized charges.
As relevant here, the fallout from the data breach implicated four
contracts. The first two bound Paymentech to Visa and MasterCard. In its
membership agreement with Visa, Paymentech agreed to participate in the
1
Given their corporate relationship, and for ease of reference, we refer to
JPMorgan Chase and Paymentech simply as “Paymentech.”
2
Case: 19-20430 Document: 00515945903 Page: 3 Date Filed: 07/21/2021
No. 19-20430
Global Compromised Account Recovery (“GCAR”) Program. And in its
membership agreement with MasterCard, Paymentech agreed to participate
in the Account Data Compromise (“ADC”) Program. These programs
protect Visa and MasterCard customers by requiring Paymentech to pay for
data-breach-related losses. Under the GCAR Program, Visa determined that
the total amount of Paymentech’s liability for the data breach was
$12,678,367.13. And under the ADC Program, MasterCard determined that
the total amount of Paymentech’s liability was $7,383,839.75.
The third contract bound Paymentech to Landry’s. In 2008,
Paymentech and Landry’s signed the Select Merchant Payment Card
Processing Agreement (the “Paymentech Agreement”). Under the
Paymentech Agreement, Landry’s was obligated to follow all Payment Brand
Rules (including the GCAR Program and ADC Program requirements),
comply with certain security guidelines, and indemnify Paymentech for any
assessments, fines, or penalties stemming from any failure by Landry’s to
comply with the Payment Brand Rules. So, according to Paymentech,
Landry’s was on the hook for the losses assessed by Visa and MasterCard.
Landry’s refused to pay.
In May 2018, Paymentech filed suit against Landry’s for breaching the
Paymentech Agreement. Paymentech, LLC & JPMorgan Chase Bank v.
Landry’s, Inc., 4:18-cv-01622 (S.D. Tex.) [hereinafter the “Underlying
Paymentech Litigation”]. Paymentech alleged that Landry’s violated the
Payment Brand Rules, which led to the data breach, which led to Visa’s and
MasterCard’s respective GCAR and ADC assessments. Therefore,
Paymentech alleged, Landry’s was obligated under the Agreement to pay the
$20,062,206.88 collectively assessed by Visa and MasterCard.
That’s when Landry’s turned to the fourth contract at issue here: its
insurance agreement with ICSOP (the “Policy”). The Policy states that
3
Case: 19-20430 Document: 00515945903 Page: 4 Date Filed: 07/21/2021
No. 19-20430
ICSOP “will pay those sums that [Landry’s] becomes legally obligated to pay
as damages because of ‘personal and advertising injury’” and “will have the
right and duty to defend [Landry’s] against any ‘suit’ seeking those
damages.” It defines “[p]ersonal and advertising injury” as “injury . . .
arising out of” several offenses, including “[o]ral or written publication, in
any manner, of material that violates a person’s right of privacy.” ICSOP
denied its duty to defend Landry’s, stating that the Underlying Paymentech
Litigation “does not qualify for coverage” because “[n]one of the . . .
‘personal and advertising injury’ triggers are implicated by the allegations in
the [Paymentech] Complaint.”
While funding its own defense against Paymentech, Landry’s filed a
separate suit against ICSOP in Texas state court. As relevant here, Landry’s
claimed that ICSOP breached the Policy. Landry’s also sought a declaratory
judgment regarding ICSOP’s duty to defend Landry’s in the Underlying
Paymentech Litigation. ICSOP removed the case to federal court. The parties
filed cross-motions for summary judgment. 2
The district court denied the motion by Landry’s, granted the motion
by ICSOP, and dismissed all the claims. In doing so, the district court held
that the Paymentech complaint did not allege a “publication” because it
asserted only that “[a] third party hacked into [the] credit card processing
system and stole customers’ credit card information.” And the district court
held that the complaint also did not allege a “violat[ion] [of] a person’s right
of privacy” because Paymentech involves the payment processor’s contract
claims, not the cardholders’ privacy claims. Landry’s timely appealed. Our
2
ICSOP moved for summary judgment on all claims based on the text of all four of
the parties’ insurance agreements. Landry’s moved for partial summary judgment, relying
on the text of only one of the insurance agreements—the Policy we analyze here—and
reserving damages for trial.
4
Case: 19-20430 Document: 00515945903 Page: 5 Date Filed: 07/21/2021
No. 19-20430
review is de novo. See Playa Vista Conroe v. Ins. Co. of the W., 989 F.3d 411,
414 (5th Cir. 2021).
II.
The question presented is whether ICSOP has a duty to defend
Landry’s in the Underlying Paymentech Litigation. To answer that question,
we apply Texas’s “eight-corners rule”—comparing the four corners of the
Policy to the four corners of the Paymentech complaint. Gonzalez v. Mid-
Continent Cas. Co., 969 F.3d 554, 557 (5th Cir. 2020).
Under the Policy, ICSOP has a duty to defend Landry’s if the
Paymentech complaint seeks damages “arising out of . . . [the] [o]ral or written
publication . . . of material that violates a person’s right of privacy.” We first
determine whether the Paymentech complaint involves a “publication.” Then
we determine whether Paymentech seeks damages “arising out of” the
“violat[ion] [of] a person’s right of privacy.”
A.
We start with the Policy’s text regarding “an oral or written
publication.” The Policy states:
“Personal and advertising injury” means injury . . . arising out
of one or more of the following offenses:
...
(d) Oral or written publication, in any manner, of material that
slanders or libels a person or organization . . . ;
(e) Oral or written publication, in any manner, of material that
violates a person’s right of privacy;
The Policy does not define “[o]ral or written publication,” so we presume
the parties intended those words to bear their plain and ordinary meaning.
See DeWitt Cnty. Elec. Co-op., Inc. v. Parks, 1 S.W.3d 96, 101 (Tex. 1999).
5
Case: 19-20430 Document: 00515945903 Page: 6 Date Filed: 07/21/2021
No. 19-20430
The contractual text and structure suggest the parties intended the
broadest possible definition of “[o]ral or written publication.” That’s for
three reasons. First, coverage is triggered by a “publication, in any manner.”
It follows that the Policy intended to use every definition of the word
“publication”—even the very broadest ones. And some of the dictionary
definitions of “publication” are quite broad. For example, Webster’s Second
defines “publication” as (1) the “[a]ct of publishing, or state of being
published; public notification, whether oral, written, or printed;
proclamation; promulgation” and (2) the “[a]ct of making public or public
property; specif., a giving over to public use, as by confiscation or
dedication.” Publication, Webster’s New International
Dictionary 2005 (2d ed. 1934; 1950) [hereinafter Webster’s
Second]. And it defines “publish” as “[t]o make known (a person,
situation, discovery, etc.) as by exposing or presenting it to view, or by openly
declaring its character or status.” Publish, Webster’s Second, at 2005
(emphasis added). The Oxford English Dictionary defines “publication” as
“that which is published.” Publication, The Oxford English
Dictionary 782 (2d ed. 1989). And it defines “publish” as (1) “[t]o make
publicly or generally known; to declare or report openly or publicly; to
announce; to tell or noise abroad; also, to propagate, disseminate,” (2) “[t]o
bring under public observation or notice; to give public notice of,” (3) “[t]o
expose to public view,” and (4) “[t]o make generally accessible or available
for acceptance or use.” Publish, The Oxford English Dictionary,
at 785. Finally, Black’s Law Dictionary simply defines “publication” as “the
act of declaring or announcing to the public.” Publication, Black’s Law
Dictionary 1423 (10th ed. 2014). Thus, if the Underlying Paymentech
Litigation concerns any of these “publications”—even merely “exposing or
presenting [information] to view”—then the Policy’s capacious provision is
satisfied.
6
Case: 19-20430 Document: 00515945903 Page: 7 Date Filed: 07/21/2021
No. 19-20430
Second, the structure of the Policy’s coverage provision confirms our
reading of the text. The “publication” requirement—an “oral or written
publication, in any manner”—is identical for both subsections (d) and (e).
So, based on the presumption of consistent usage, we assume the parties
intended the word “publication” to have the same meaning in both
subsections. See Antonin Scalia & Bryan Garner, Reading
Law 170 (2012) (“A word or phrase is presumed to bear the same meaning
throughout a text; a material variation in terms suggests a variation in
meaning.”). That means the “publication” requirement in both subsections
must be at least as broad as the tort of defamation (captured in subsection
(d)), which merely requires transmission of information to one other person.
See, e.g., Exxon Mobil Corp. v. Rincones, 520 S.W.3d 572, 579 (Tex. 2017)
(listing “the publication of a false statement of fact to a third party” as an
element of a defamation claim, and stating that defamatory “[p]ublication
occurs if the defamatory statements are communicated orally, in writing, or
in print to some third person who is capable of understanding their
defamatory import and in such a way that the third person did so
understand” (quotation omitted)).
Third and finally, if there’s any ambiguity in the Policy, it must be
resolved in favor of Landry’s. See St. Paul Fire & Marine Ins. Co. v. Green Tree
Fin. Corp.-Tex., 249 F.3d 389, 392 (5th Cir. 2001). “If any allegation in the
complaint is even potentially covered by the policy then the insurer has a duty
to defend its insured.” Primrose Operating Co. v. Nat’l Am. Ins. Co., 382 F.3d
546, 552 (5th Cir. 2004) (quotation omitted). That further supports our
reading of the word “publication” to embrace the broadest possible plain
meaning of the term.
The Paymentech complaint plainly alleges that Landry’s published its
customers’ credit-card information—that is, exposed it to view. In fact, the
Paymentech complaint alleges two different types of “publication.” The
7
Case: 19-20430 Document: 00515945903 Page: 8 Date Filed: 07/21/2021
No. 19-20430
complaint first alleges that Landry’s published customers’ credit-card data
to hackers. Specifically, as the credit-card “data was being routed through
affected systems,” Landry’s allegedly exposed that data—including each
“cardholder name, card number, expiration date and internal verification
code.” Second, the Paymentech complaint alleges that hackers published the
credit-card data by using it to make fraudulent purchases. Both disclosures
“expos[ed] or present[ed] [the credit-card information] to view.” Publish,
Webster’s Second, at 2005. And either one standing alone would
constitute the sort of “publication” required by the Policy. 3
B.
Having established that the Underlying Paymentech Litigation involves
at least one “publication,” we next determine whether it involves an injury
“arising out of . . . the violat[ion] [of] a person’s right of privacy.”
Again, we start with the text of the Policy. The operative text begins
with the words “arising out of.” These words again connote breadth. See,
e.g., Prima Paint Corp. v. Flood & Conklin Mfg. Co., 388 U.S. 395, 398 (1967)
(describing as “broad” a contractual clause regarding “[a]ny controversy or
claim arising out of or relating to this Agreement”); Nauru Phosphate
3
For present purposes, it’s irrelevant whether Landry’s did in fact cause the
publications and hence cause the personal and advertising injuries. This case relates only
to ICSOP’s duty to defend Landry’s in the Underlying Paymentech Litigation, not the duty
to indemnify the company should it be found liable. See St. Paul Fire, 249 F.3d at 391
(stating that because “[a]n insurance company’s duty to defend is broader than its duty to
indemnify,” we can find and “enforce an insurer’s duty to defend even when an insurer’s
duty to indemnify is not yet settled”). So it only matters (for duty to defend purposes) that
Paymentech alleges a publication of the data. Cf. Nat’l Union Fire Ins. Co. v. Merchants Fast
Motor Lines, Inc., 939 S.W.2d 139, 141 (Tex. 1997) (holding that even if “the complaint does
not state facts sufficient to clearly bring the case within or without the coverage, the general
rule is that the insurer is obligated to defend if there is, potentially, a case under the
complaint within the coverage of the policy” (emphases added) (quotation omitted)).
8
Case: 19-20430 Document: 00515945903 Page: 9 Date Filed: 07/21/2021
No. 19-20430
Royalties, Inc. v. Drago Daic Interests, Inc., 138 F.3d 160, 165 (5th Cir. 1998)
(holding that when parties agree to an arbitration clause governing “[a]ny
dispute . . . arising out of or in connection with or relating to this Agreement,”
they “intend the clause to reach all aspects of the relationship” (quotation
omitted)). Thus, the Policy does not simply extend to violations of privacy
rights; the Policy instead extends to all injuries that arise out of such
violations.
Next, the Policy insures against “violat[ions of] a person’s right of
privacy.” We need not tarry long on this phrase because it’s undisputed that
a person has a “right of privacy” in his or her credit-card data. It’s also
undisputed that hackers’ theft of credit-card data and use of that data to make
fraudulent purchases constitute “violations” of consumers’ privacy rights.
And it’s still further undisputed that the Paymentech complaint alleges such
theft and such fraudulent purchases. Thus, the plain text of the Policy
anticipates ICSOP’s duty to defend in the Underlying Paymentech Litigation.
ICSOP urges us not to follow the plain text of the Policy and instead
to alter it. In ICSOP’s view, the Policy covers only tort damages “arising out
of . . . the violation of a person’s right of privacy.” Thus, ICSOP suggests, it
might defend Landry’s if it were sued in tort by the individual customers who
had their credit-card data hacked and fraudulently used. But ICSOP thinks it
bears no obligation to defend Landry’s in a breach-of-contract action brought
by Paymentech. Of course, the Policy contains none of these salami-slicing
distinctions.
Under Texas law, that’s dispositive. Take Lamar Homes, Inc. v. Mid-
Continent Casualty Co., 242 S.W.3d 1 (Tex. 2007). In that case, a
homebuilder wanted its insurance company to defend a suit filed by two
homebuyers alleging foundation defects. Id. at 5. The homebuilder’s
insurance policy stated that its insurer would “defend the insured against any
9
Case: 19-20430 Document: 00515945903 Page: 10 Date Filed: 07/21/2021
No. 19-20430
‘suit’ seeking . . . damages” because of “bodily injury” or “property
damage” caused by an “occurrence.” Id. at 6. The insurer read “bodily
injury” and “property damage” to cover tort claims and not contract claims.
Id. at 13. But the Texas Supreme Court disagreed. It noted that the policy
“ma[de] no distinction between tort and contract damages.” Ibid. So, based
on the established principle that “[t]he duty to defend must be determined
under the eight-corners rule rather than by the labels attached to the
underlying claims,” the court’s “proper inquiry [wa]s whether an
‘occurrence’ ha[d] caused ‘property damage,’ not whether the ultimate
remedy for the claim [sounded] in contract or in tort.” Id. at 15–16. That’s a
different way of saying that we must focus on “the facts alleged” in the
complaint, “not on the actual legal theories” invoked. St. Paul Fire, 249 F.3d
at 391–92.
Here, everyone agrees that the facts alleged in the Paymentech
complaint constitute an injury arising from the violation of customers’
privacy rights, as those terms are commonly understood. It does not matter
that Paymentech’s legal theories sound in contract rather than tort. Nor does
it matter that Paymentech (rather than individual customers) sued Landry’s.
Paymentech’s alleged injuries arise from the violations of customers’ rights
to keep their credit-card data private. Under the eight-corners rule, ICSOP
must defend Landry’s in the Underlying Paymentech Litigation. 4
* * *
4
The district court did not address the Policy’s Self-Insured Retention
Endorsement, which ICSOP offered as an alternative ground for denying its duty to defend.
We express no view on it. See Cutter v. Wilkinson, 544 U.S. 709, 718 n.7 (2005) (“[W]e are
a court of review, not of first view[.]”).
10
Case: 19-20430 Document: 00515945903 Page: 11 Date Filed: 07/21/2021
No. 19-20430
The judgment of the district court is REVERSED, and the case is
REMANDED for further proceedings consistent with this opinion.
11