Aggressive Liability Theory Does Not Eliminate Obstacles To Banks’ Claims In Target Data Breach Class Action

The latest salvo in the Target data breach litigation is a class action brought by credit card issuing banks advancing a creative and somewhat misleading construction of the Minnesota's Plastic Card Security Act.  The banks allege that there was a violation of the statute's prohibition on retaining PIN, security code and other magnetic swipe data more than 48 hours after a transaction.  The problem with that theory is that Target's system does not retain card holder data, nor was the theft of data directed toward stored data.  Instead, the hackers loaded malware onto Target's point of sale (POS) system which allowed the criminals to capture card holder data as cards were swiped.  The hackers then tucked the card data away in a highjacked file location elsewhere on the Target system, before porting that data to locations in Russia and Miami.  In other words, Target wasn't storing the unauthorized data; the criminals were, without Target's knowledge.