A Settlement Targeted Toward Banks?

Commercial class-action practitioner Kevin M. McGinty here describes the final settlement of the infamous 2013 theft of credit and debit card data from retail giant Target’s point-of sale terminals:

On Tuesday, December 1, Target entered into a settlement agreement with a class of banks and financial institutions that issued the credit and debit cards that were compromised in the 2013 event.  The settlement was the result of negotiations following closely on the heels of an order by the court certifying a card issuer class.  This last settlement resolves card issuers’ claims that were not previously resolved in Target’s August 2015 settlement with Visa, which provided $67 million to resolve claims made by Visa card issuing banks under Visa’s fraud resolution process.  Also separate from this settlement is the $10 million settlement of the claims of consumers whose cards were compromised by the data theft, which Target concluded with the consumer class in March 2015.

The current settlement provides for payment of an additional $39,357,939.38 for the benefit of class member banks.  Of that amount, $19,107,939.38 will be used to fund settlements under MasterCard’s fraud resolution process….

The $10 million paid in the consumer settlement may seem at first blush to be grossly disproportionate to the roughly $107 million allocated to the card networks and their issuing banks. It actually isn’t. The card payment system is built on private contracts that are themselves heavily impacted by federal consumer protection laws like the Truth-in-Lending Act and the Electronic-Funds-Transfer Act. Together, the contracts and federal law place liability for unauthorized purchases squarely on the issuer banks acting through the card networks.  Thus, we should expect the consumer losses from Target’s data breach to be minimal compared to those borne by the banks, who were obligated to fund the consumer losses pending recovery from Target as the ultimately responsible party for this particular data breach.

Sometimes the legal system works more-or-less how it is intended. The consumers actually were protected in this instance.