A recent Sixth Circuit Court of Appeals decision applying an indemnity provision to a data breach claim vividly demonstrates how a front-end contract review can head off troublesome back-end liability, and underscores the importance of understanding the practical effects of standard and often innocuous contract clauses
before entering into a contract.
The case –
Spec’s Family Partners v. First Data Merchant Services – involved a data breach of the credit card payment system at Spec’s, a chain of family-owned liquor stores, due to the failure of Spec’s to comply with certain industry security standards.The credit card companies and their banks paid the defrauded cardholders and sought reimbursement from First Data, the company that had contracted with Spec’s to process the credit card payments. First Data, in turn, sought reimbursement from Spec’s and, when Spec’s refused, withheld over $6 million in payments from Spec’s, prompting Spec’s to sue.
Even though the failure of Spec’s to comply with standard security procedures caused the data breach, Spec’s prevailed on its breach of contract claim against First Data because of two standard contract provisions – indemnification and a limitation on consequential damages. First Data relied on a standard indemnity provision in the contract that obligated Spec’s to pay for losses caused by its own wrongful acts. Spec’s, however, countered with another standard contract provision, a clause shielding both parties from claims for consequential damages. The trial court found that this standard limitation on consequential damages applied to any indemnification obligations. Because the losses being sought by First Data to Spec’s constituted consequential damages, the court ruled that First Data was not entitled to reimbursement for those payments, and the Sixth Circuit affirmed. Read the full opinion
here.
At first blush, the indemnification provision in the contract was standard – it protected First Data from damages caused by the conduct of Spec’s. But the protection offered by that clause was significantly eroded by the accompanying limitation in another standard provision limiting consequential damages. The lesson is clear: because the reflexive use of standard contract provisions can significantly impact liability, it is crucial to assess –
before the contract is signed – the practical effects of the standard clauses and their interrelation with one another. Failure to do so can result in significant unintended liability.