March 15, 2013, 12:09 PM — Specialty retailer Genesco faces an uphill battle in its precedent-setting $13.3 million lawsuit against Visa USA Inc., a Garner analyst said this week.
Genesco's lawsuit accuses Visa of illegally and unjustifiably imposing multimillion-dollar fines on the retailer over a 2010 data intrusion.
The intrusion resulted in Visa's issuing an alert to credit-card issuing banks warning them that all Visa payment cards handled by Genesco over the year between December 2009 and December 2010 had been compromised. The episode resulted in Genesco's having to pay a total of $13.3 million in fines.
In its lawsuit, Genesco claimed the fines were unjustified. It noted that Visa's own rules for payment card transactions specify fines only in situations where a breach occurred because of a company's failure to comply with the requirements of the Payment Card Industry Data Security Standards. Even then, fines are applicable only if more than 10,000 cards are compromised. There also needs to be actual and demonstrable financial damage resulting from fraud or counterfeiting before a fine can be imposed, Genesco said.
None of these situations applied with the 2010 intrusion, Genesco said in its complaint. The company claimed that it had been fully compliant with PCI requirements at the time of the breach. As required under PCI, no card data was ever stored on Genesco's systems at any time during the intrusion.
The only card data that was potentially exposed was the unencrypted card data being transmitted for approval. Visa's own rules at the time did not require companies to encrypt such data while it was being transmitted, Genesco maintained. The company also claimed that Visa had failed to show how the intrusion had resulted in any actual losses to either the company or to the banks that had issued the cards.
Genesco's reaction is understandable, said Gartner analyst Avivah Litan. Over the years, credit card companies such as Visa and MasterCard have hit merchants with hefty fines for data breaches allegedly resulting from non-compliance with PCI rules. Some companies have chafed at the fines and have maintained that they were fully compliant with PCI requirements when they were breached.
Visa did not respond to a request for comment.
Genesco's lawsuit marks the first time that a breached entity has challenged Visa's fines.
"I certainly can understand the frustration of Genesco here but I think legally it may be tricky," Litan said. The case challenges some of the fundamental payment system rules and regulations governing credit and debit card transactions that were put in place by companies such as Visa and MasterCard, she noted.