In Re TJX Companies Retail SEC. Breach Litigation

564 F.3d 489 (2009) In re TJX COMPANIES RETAIL SECURITY BREACH LITIGATION. AmeriFirst Bank and Selco Community Credit Union, Plaintiffs, Appellees/Cross-Appellants, v. TJX Companies, Inc., Fifth Third Bank and Fifth Third Bancorp, Defendants, Appellants/Cross-Appellees. Nos. 07-2828, 08-1075, 08-1076. United States Court of Appeals, First Circuit. Heard December 2, 2008. Decided March 30, 2009. As Amended on Rehearing in Part May 5, 2009. *491 Douglas H. Meal with whom Richard D. Batchelder, Jr. and Ropes & Gray LLP were on brief for TJX Companies, Inc. W. Breck Weigel with whom Robert N. Webner, Vorys, Sater, Seymour and Pease LLP, James R. Carroll, Nicholas I. Leitzes and Skadden, Arps, Slate, Meagher & Flom LLP were on brief for Fifth Third Bank and Fifth Third Bancorp. Joe R. Whatley, Jr. with whom Patrick J. Sheehan, Whatley Drake & Kallas, LLC, Archie C. Lamb, Jr., F. Inge Johnstone and The Lamb Firm, LLC were on brief for AmeriFirst Bank and SELCO Community Credit Union. Before BOUDIN, LIPEZ and HOWARD, Circuit Judges. BOUDIN, Circuit Judge. Before us are cross-appeals stemming from a well known incident: the theft from TJX computers of customer credit and debit card information and the subsequent fraudulent use of the information. See generally In re TJX Cos. Retail Sec. Breach Litig., 493 F.Supp.2d 1382 (D.Mass.2007); McMorris v. TJX, 493 F.Supp.2d 158 (D.Mass.2007). Law suits ensued, this case—involving banks injured in the debacle—among them. In January 2007, TJX Companies, Inc. ("TJX"), headquartered in Massachusetts and a major operator of discount stores, revealed that its computer systems had been hacked. Credit or debit card data for millions of its customers had been stolen. Harm resulted not only to customers but, it appears, also to banks that had issued the cards ("issuing banks"), which were forced to reimburse customers for fraudulent use of the cards and incurred other expenses. In May 2007, AmeriFirst Bank, based in Alabama, filed suit in the federal district court in Massachusetts against TJX and, in addition, against an Ohio bank and its parent—Fifth Third Bank and Fifth Third Bancorp (collectively "Fifth Third").[1]*492 Fifth Third served as "processing bank" for TJX transactions, receiving the data from the customer's initial charge for a purchase and, after high-speed verification from the issuing bank, authorizing the charge. Visa and MasterCard each had a network and regime for such purposes. AmeriFirst's complaint, seeking class action status for issuing banks, charged that both TJX and Fifth Third were variously at fault: that TJX and Fifth Third failed to follow security protocols prescribed by Visa and MasterCard to safeguard personal and financial information; that the breaches occurred from July 2005 onward but were discovered and disclosed only later; and that the issuing banks suffered losses from reimbursing customers for fraud losses, monitoring customers accounts, and cancelling and reissuing cards. The multi-count complaint charged (1) negligence, (2) breach of contract, (3) negligent misrepresentation, and (4) unfair or deceptive practices under chapter 93A, Mass. Gen. Laws ch. 93A (2008). The defendants moved to dismiss for failure to state a claim. Fed.R.Civ.P. 12(b)(6). On October 12, 2007, the district court dismissed the negligence and breach of contract claims but refused to dismiss claims based on negligent misrepresentation and chapter 93A. (A fifth claim, for "negligence per se," was dismissed and is not at issue.) In re TJX Cos. Retail Sec. Breach Litig., 524 F.Supp.2d 83. Plaintiffs then moved to amend their complaint, seeking to add a claim for conversion and also new facts to the chapter 93A claim. On November 29, 2007, the district court provisionally denied class status; if made final, this denial would in turn defeat subject matter jurisdiction based on the minimal diversity provisions of the Class Action Fairness Act, 28 U.S.C. § 1332 (2006). The court invited briefing as to whether, if class action status were ultimately denied, it should transfer the case to state court. In re TJX Cos. Retail Sec. Breach Litig., 246 F.R.D. 389. On December 18, 2007, the court denied the motion to amend the complaint, it made the denial of class status final, and it ordered the transfer of the case to the Massachusetts Superior Court. Although all but two of the claims had been dismissed, the district court designated its pre-transfer rulings as "without prejudice" to reconsideration by the state court. At defendants' request, this court stayed the transfer pending review on appeal. TJX and Fifth Third now appeal to this court, urging principally that all claims against them should have been dismissed with prejudice and that in any event transfer to the state court was precluded by governing precedent. AmeriFirst and SELCO raise standing and finality objections to defendants' appeal and ask for affirmance of the transfer order; but by cross appeal, they say that dismissal of their other claims was error and that both class action status and the motion to amend should have been allowed. Jurisdiction, Standing and Finality. Although no party has questioned it, we are compelled to consider first an oddity that might seem to imperil subject matter jurisdiction. Jurisdiction in the district court rested on the minimum diversity provision available only for class actions, 28 U.S.C. § 1332, and ultimately the district court ruled that class certification was improper. So one might ask: how do the *493 parties now get to litigate on the merits whether specific counts did or did not state claims? The answer is the district judge had provisional jurisdiction to decide those merits issues—because whether class action status was sustainable depended in part on what claims were on the table. "In such cases it is both proper and necessary for the trial court first to resolve the merits of the claim to the extent necessary to allow the court to properly determine its own jurisdiction." Augustine v. United States, 704 F.2d 1074, 1079 (9th Cir.1983). See generally Bell v. Hood, 327 U.S. 678, 66 S.Ct. 773, 90 L.Ed. 939 (1946). In the end, after disposing of standing and finality objections, our analysis of the claims—both those sustained and those dismissed—leads us to agree for the most part with the able district judge's analysis (although not with the transfer order) but to disagree in one respect that reopens the class action issue. We therefore end by remanding for further proceedings as explained below. The standing and finality objections are directed to bar defendants' argument that two remaining counts of the complaint—negligent misrepresentation and chapter 93A—should have been dismissed. Plaintiffs say that because the district court dismissed other counts and thereafter transferred the case, the merits rulings against the defendants on the remaining counts caused no harm to them, beyond speculative collateral estoppel effects that might flow from the rulings in future litigation. Because the district court ruled that the two counts stated viable claims, the defendants were plainly and concretely disadvantaged: instead of an end to the liability claims, they now face further litigation of these claims (indeed, in this very case, because the transfer turns out to be invalid and the claims may still end up going forward in the district court). They are thus entitled to appeal from the adverse ruling—assuming that the ruling is embodied in a final judgment. 28 U.S.C. § 1291. Ordinarily a defendant may not appeal from a denial of a Rule 12(b)(6) motion because the litigation in the trial court will not have concluded. But here the district court brought the case before it to an end by the class action ruling and purported transfer. Appeals from transfers between federal courts are sometimes immediately appealable and sometimes not; but where the transfer court lacks power to transfer, an order purporting to do so can hardly defeat review of an otherwise final judgment. Plaintiffs also argue that the defendants' appeal is barred because the district court said that its merits rulings were without prejudice to reconsideration by the state courts. Dismissals without prejudice are sometimes deemed to prevent an immediate appeal where they represent an invitation to a plaintiff to cure some technical deficiency by re-filing in the same court. E.g., Umbenhauer v. Woog, 969 F.2d 25, 30 (3rd Cir.1992). In this case, no such invitation was extended by the district court. Finally plaintiffs invoke Balcom v. Lynn Ladder & Scaffolding Co., 806 F.2d 1127 (1st Cir.1986), which refused to allow a third-party defendant, vindicated by a jury, to appeal from a judgment in its favor. This defendant wanted to challenge jury findings, fearing that they would prejudice it in future litigation. This court said that the findings were not essential to the judgment and thus would have no collateral estoppel effect. Id. at 1127. Balcom is clearly not on point. *494 Negligent misrepresentation. We therefore turn to the merits of defendants' appeal, starting with the negligent misrepresentation claim which the district court found adequately alleged for purposes of Rule 12(b)(6). Review of Rule 12(b)(6) rulings is de novo. First Medical Health Plan, Inc. v. Vega-Ramos, 479 F.3d 46, 51 (1st Cir.2007). At the outset, one has to understand the nature of the claim as stated in the complaint and as thereafter clarified by the plaintiffs in resisting the motion to dismiss. The complaint alleged that Fifth Third has contracts with MasterCard and Visa that require compliance with operating regulations adopted by each credit card organization and that TJX and Fifth Third similarly have a contract that requires TJX to comply with such regulations. It further alleged that TJX and Fifth Third ignored security measures required by the operating regulations—for examples, that signatories deploy a firewall configuration, protect stored data, encrypt transmission of cardholder data, and track access to cardholder data and network resources. But although TJX and Fifth Third are charged in the complaint with misrepresentations, the plaintiffs' claim—as elaborated in their district court filings and brief on appeal—appears to rest (with one doubtful exception as to Fifth Third[2]) on a flimsier foundation than actual misrepresentation. Rather, plaintiffs argue that by accepting credit cards and processing payment authorizations, defendants impliedly represented that they would comply with MasterCard and Visa regulations and this was the negligent misrepresentation. Massachusetts law defines negligent misrepresentation using the Restatement (Second) of Torts (1977), which in section 552 requires the following elements: One who, in the course of his business, profession or employment, or in any other transaction in which he has a pecuniary interest, supplies false information for the guidance of others in their business transactions, is subject to liability for pecuniary loss caused to them by their justifiable reliance upon the information, if he fails to exercise reasonable care or competence in obtaining or communicating the information. Nycal Corp. v. KPMG Peat Marwick LLP, 426 Mass. 491, 495-96, 688 N.E.2d 1368 (1998)(quoting the Restatement). It would almost surely stretch Massachusetts law too far to say that merely doing credit card transactions with issuing banks, whether directly (Fifth Third) or indirectly (TJX), is a representation implied by conduct to third parties that the defendants were complying with detailed security specifications of Visa and MasterCard. The implication is implausible and converts the cause of action into liability for negligence—without the limitations otherwise applicable to negligence claims. Conduct can be part of a representation, but the link between the conduct and the implication is typically tight. Thus, in Danca v. Taunton Sav. Bank, 385 Mass. 1, 9, 429 N.E.2d 1129 (1982), the court upheld an implied representation claim where plaintiffs, in applying for a mortgage, were told by the bank that it needed to assure compliance with a zoning requirement; later by a combination of *495 words and action, the bank led the plaintiffs to believe that the bank had found compliance. More recently the SJC said of Danca: We emphasized the importance to our decision of the defendant's "conduct and words" and "response to the plaintiffs' inquiry," holding it sufficient "that the representation was reasonably understood as a statement that the bank employees had looked at the plan and found no problems." Page v. Frazier, 388 Mass. 55, 66-67, 445 N.E.2d 148 (1983) (quoting Danca, 385 Mass. at 9, 429 N.E.2d 1129). Yet we stop short of holding that the district court had to dismiss the misrepresentation claim in this case on the face of a complaint that explicitly alleged misrepresentation. Recently the Massachusetts trial court refused to dismiss virtually the same claim brought by credit unions against Fifth Third and another defendant for credit card losses resulting from a security breach. CUMIS Ins. Soc., Inc. v. BJ's Wholesale Club, Inc., 23 Mass. L.Reptr. 550, 2005 WL 6075375 (Mass.Super.2005). Plaintiffs naturally rely on this decision, as did the district court. Then, on summary judgment in CUMIS, it became crystal clear that the charge of "misrepresentation" rested simply on the doing of credit card business—the same implication from conduct argument that plaintiffs offer in this case. The CUMIS court then granted summary judgment for defendants because inter alia such conduct was not a misrepresentation under Massachusetts law. CUMIS Ins. Soc., Inc. v. BJ's Wholesale Club, Inc., 24 Mass. L. Rep. 117, *11-12 (Mass.Super.2008). The ultimate disposition is therefore far more helpful to defendants. Ordinarily a district court does not have to look behind the complaint and grant a motion to dismiss because later statements by the plaintiff offer a narrower picture of what plaintiff expects to prove at trial. Had the second CUMIS decision been available, the district court might well have granted the motion, but summary judgment is the more common method of disposing of claims that are facially valid but prove (usually after discovery) to be unsupported by evidence. The present claim thus survives, but on life support. Chapter 93A. The provisions of chapter 93A invoked by plaintiffs, M.G.L. ch. 93A §§ 2, 11, pertinently provide for a claim for "unfair" or "deceptive" trade practices as between businesses—the unfairness label in these provisions being a cross-reference to more specific standards borrowed from an appropriate source of law. Ciardi v. F. Hoffmann-La Roche, Ltd., 436 Mass. 53, 70-72, 762 N.E.2d 303 (2002). Plaintiffs offered three different theories invoking specific standards: • negligent misrepresentation (already alleged as a separate tort) under Massachusetts law, • violation of section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45(a)(1) (2006), which chapter 93A cross-references,[3] and • violation of a federal statute that protects information that customers confide to financial institutions, Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 (2006). *496 The district court sustained only the first of these theories and it rejected the other two. The negligent misrepresentation claim is likely to have no future in this case for reasons just explained and, if it falls, so too does its use under chapter 93A. Townsends, Inc. v. Beaupre, 47 Mass.App.Ct. 747, 755, 716 N.E.2d 160 (1999). Further, the district court found—and we below uphold its ruling—that the negligent misrepresentation claim, whether standing alone or under chapter 93A, is not certifiable under the class action rubric. This brings us to the second theory (plaintiffs have abandoned the third). Plaintiffs contend that their second theory—that defendants' lack of security measures was "unfair" under the Federal Trade Commission Act—provides an alternative basis for its chapter 93A claim. The district court disagreed, saying that the unfairness characterization rested on consent decrees of the Federal Trade Commission and (the court said) a consent decree is not under Massachusetts law an authoritative determination for purposes of chapter 93A. Whitinsville Plaza, Inc. v. Kotseas, 378 Mass. 85, 101, 390 N.E.2d 243 (1979). Plaintiffs read the case more narrowly. To bring conduct within the unfairness rubric of chapter 93A does not require that it have been specifically condemned by the FTC which has itself identified general factors to consider in identifying unfairness. The SJC has held that Relying on FTC interpretations ... the following are "considerations to be used in determining whether a practice is to be deemed unfair": `(1) whether the practice ... is within at least the penumbra of some common-law, statutory, or other established concept of unfairness; (2) ... is immoral, unethical, oppressive, or unscrupulous; (3) ... causes substantial injury [to] ... competitors or other businessmen.'[4] Datacomm is itself an example of this approach. Id.; see also Chapter 93A Rights & Remedies § 2.3.1 (Hon. Margot Botsford ed., MCLE 2d ed. 2007). If the charges in the complaint are true (and obviously the details matter), a court using these general FTC criteria might well find in the present case inexcusable and protracted reckless conduct, aggravated by failure to give prompt notice when lapses were discovered internally, and causing very widespread and serious harm to other companies and to innumberable consumers. And such conduct, a court might conclude, is conduct unfair, oppressive and highly injurious—and so in violation of chapter 93A under the FTC's interpretation. Further, we do not think irrelevant the host of FTC complaints and consent decrees condemning as "unfair conduct" specific behavior similar to that charged by plaintiffs. Whitinsville's broad language occurred where the court itself concluded on the merits that the conduct in question—a legal challenge in court—was reasonably justified; and the decision may mean no more than that a consent decree does not establish a per se violation. Whitinsville, 378 Mass at 101, 390 N.E.2d 243. Further, Whitinsville is not the SJC's only or latest word on the subject. On the contrary, prior to Whitinsville the SJC had expressly relied on an FTC *497 consent decree in one case, Schubach v. Household Finance Corp., 375 Mass. 133, 135, 376 N.E.2d 140 (1978), and FTC advisory opinions in another, PMP, supra, 366 Mass. at 598-99; and, quite recently, the SJC invoked a consent decree secured by the Federal Deposit Insurance Corporation as providing relevant standards under chapter 93A (although not to establish liability since consent decrees do not usually determine facts): The fact that the FDIC ordered Fremont to cease and desist from the use of almost precisely the loan features that are included in the judge's list of presumptively unfair characteristics indicates that the FDIC considered that under established mortgage lending standards, the marketing of loans with these features constituted unsafe and unsound banking practice with clearly harmful consequences for borrowers. Such unsafe and unsound conduct on the part of a lender, insofar as it leads directly to injury for consumers, qualifies as "unfair" under G.L. c. 93A, § 2. Commonwealth v. Fremont Inv. & Loan, 452 Mass. 733, 747-48, 897 N.E.2d 548 (2008). Where, as here, a substantial body of FTC complaints and consent decrees focus on a class of conduct, it is hard to see why a court would choose flatly to ignore it. FTC precedent and factors serve to offset the vagueness of chapter 93A; but they are ordinarily instructive rather than conclusive. In all events, whether one relies on the general FTC factors identified above or the more precise precedents, the plaintiffs chapter 93A claim based on an FTCA theory should not be dismissed on the complaint—unless derailed by other counter-arguments to which we now turn. The first—that chapter 93A requires a closer association than its indirect connection with AmeriFirst—was answered by the district court. Case law does require a business relationship, e.g., Imprimis Investors, LLC v. KPMG Peat Marwick LLP, 69 Mass.App.Ct. 218, 230-31, 868 N.E.2d 143 (2007), but here a jury might say that TJX was regularly seeking payment from the issuing banks through an intermediary (Fifth Third) and that this is a close enough connection. At least at the complaint stage, this seems enough. TJX next argues correctly that chapter 93A is intended exclusively for egregious conduct, see Ahern v. Scholz, 85 F.3d 774, 797-98 (1st Cir.1996), and—it contends— that either deliberate wrongdoing or personal benefit is present in virtually all of the sound case law. Perhaps policy might make this a desirable stopping point, given the vagueness of the unfairness standard and availability of a private damages remedy unchecked by agency prudence. But Massachusetts decisions do not say that deliberate wrongdoing or self-benefit are required; seemingly systematic recklessness may suffice.[5] Knowing so little about the extent of TJX's or Fifth Third's fault at the complaint stage, we think that at best TJX's argument is one that would have to await discovery and perhaps a summary judgment motion. The procedural *498 caution shown in CUMIS is easily justified on this issue. Finally, Fifth Third argues that the chapter 93A claim must fail against it because none of its acts occurred "primarily" or "substantially" within Massachusetts. See M.G.L. ch. 93A, § 11. But again, the allegations are sufficient at this stage. Fifth Third is alleged to have an office or offices in Massachusetts, which under CUMIS is arguably sufficient, 23 Mass. L.Rptr. 550, at *16-17; and presumably Fifth Third's communicating to and from TJX's servers in Massachusetts is part of the causal chain. One final point as to the unfairness-based claim under chapter 93A. The district court indicated, in its decision on October 12, 2007, that federal subject matter jurisdiction might independently attach to such a claim—regardless of class action status—because a federal issue might be deemed embedded in the state law claim. It did not pursue the issue because it rejected the theory; but we are now reinstating that theory and class action status is at best uncertain. The embedded issue theory, associated with Smith v. Kansas City, 255 U.S. 180, 41 S.Ct. 243, 65 L.Ed. 577 (1921), raises a complicated and much mooted problem as to the proper construction of the "federal question" statute. 28 U.S.C. § 1331. The answer may not matter in this case: the district court's class-action analysis suggested that because individual bank recoveries may be small, the plaintiffs may have no practical interest in pursuing this case unless certification is granted. But if the Smith theory becomes critical, jurisdiction should not be assumed merely because the state claim resorts to federal precedent; nor is it perfectly clear that Massachusetts regards the section 5 standard as binding (as opposed to merely informative precedent to be considered)— which would arguably not suffice even under Smith. It is enough to warn that there is precedent and commentary that would have to be consulted and briefed if and when necessary.[6] Negligence. Plaintiffs say that the district court erred in dismissing their simple negligence claim, a ruling that it based upon the so called economic loss doctrine. Massachusetts, which is not alone, holds that "purely economic losses are unrecoverable in tort and strict liability actions in the absence of personal injury or property damage." Aldrich v. ADD Inc., 437 Mass. 213, 222, 770 N.E.2d 447 (2002). Like "duty" and "proximate cause," the doctrine cabins what could otherwise be open-ended negligence liability to anyone affected by a negligent act. AmeriFirst says that it did suffer property damage because it had a property interest in the payment card information, which the security breach rendered worthless. Electronic data can have value and the value can be lost, but the loss here is not a result of physical destruction of property. Indeed, a reduction in real property value, by dumping of contaminants in the neighborhood but not on plaintiff's property was held to be economic loss. Lewis v. General Electric, 37 F.Supp.2d 55 (D.Mass.1999). Plaintiffs offer policy arguments for limiting the economic loss doctrine, but the physical injury requirement reflects existing *499 precedent, Lewis; Am. Tel. & Tel. Co. v. IMR Capital Corp., 888 F.Supp. 221, 247 (D.Mass.1995). CUMIS itself invoked the economic loss doctrine to bar a negligence claim on the same facts. 23 Mass. L.Rptr. 550, at *8-9. Accord, Pa. State Employees Credit Union v. Fifth Third Bank, 398 F.Supp.2d. 317, 326 (M.D.Pa. 2005). Nor will we certify an issue where state law is clear. Cantwell v. Univ. of Mass., 551 F.2d 879, 880 (1st Cir.1977). Breach of contract. Plaintiffs also do not persuade us that the district court erred in dismissing their contract claims. Here, Visa and MasterCard bound participating banks like Fifth Third to certain security procedures and approving banks like Fifth Third bound sellers like TJX for whom they processed payments; but the issuing banks were not parties to either of these contracts and can therefore bring claims only if they were third-party beneficiaries. Massachusetts law follows the third-party beneficiary test of the Restatement (Second) of Contracts § 302 (1981), see Rae v. Air-Speed, Inc., 386 Mass. 187, 195, 435 N.E.2d 628 (1982), which is relatively hospitable to claims by those purporting to be third-party beneficiaries—except where the direct parties to the contract have "otherwise agreed." Section 302(1) states: Unless otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intention of the parties and ... the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. The parties to the contracts in this case appear to have "otherwise agreed." The agreement between Fifth Third and TJX provides: "This Agreement is for the benefit of, and may be enforced only by, Bank and Merchant ... and is not for the benefit of, and may not be enforced by any third party." Plaintiffs argue that this express language is superceded by provisions in the MasterCard and Visa Operating Regulations. The regulations do say that they prevail where they conflict with provisions in the merchant agreements, but here the regulations do not conflict. Instead, the MasterCard Operating Regulations state that MasterCard "shall have the sole right to interpret and enforce" its regulations, and the Visa Operating Regulations say that they "do not constitute a third-party beneficiary contract as to any entity or person ... or confer any rights, privileges, or claims of any kind as to any third parties." CUMIS is in accord. 23 Mass.L.Rptr. 550, at *5-6. See also Pa. State Employees Credit Union, 398 F.Supp.2d at 323-26. Conversion. Plaintiffs did not plead a claim for conversion in their original or amended complaint but sought to add it on October 25, 2007, a month after submitting the amended complaint. The district court denied the motion on the ground that the claim was not viable, saying that conversion related only to interference with tangible property, and that plaintiffs claim concerned intangible property. We review this denial for abuse of discretion. Aponte-Torres v. Univ. of P.R., 445 F.3d 50, 58 (1st Cir.2006). Whether or not Massachusetts limits conversion claims to tangible property is debatable,[7] but even if it does not, such a claim is less than a neat fit. Conversion *500 implies appropriation, which is hardly the first word that comes to mind—to describe the store's behavior—when a customer gives a store a credit card and the data is then filched from the store by a third party. Still, the conversion concept is loosely defined, under Massachusetts law as elsewhere, e.g., Kelley v. LaForce, 288 F.3d 1, 11-12 (1st Cir.2002); so perhaps this too is a debatable issue. In all events, the claim is not straightforward, could have been presented in the original complaint, and does not depend on newly discovered facts. The district court's decision not to entertain a belated claim on top of numerous ones already pled and under consideration, was not an abuse of discretion. Nor did the court have to allow belated amendment of the chapter 93A claim to add facts that could have been asserted earlier. Class certification. After determining which claims survived, the district court then applied the customary tests to decide whether class action status could be sustained for the case, see Fed.R.Civ.P. 23(a), (b), and provisionally concluded that certification was not justified. This judgment was explicitly limited to the two claims that survived. Ultimately, the district court denied the request to amend and made final its denial of class status. Plaintiffs expressly decline to appeal from the denial of class certification of the two claims in question—the negligent representation claim and the chapter 93A claim resting on the same theory. But arguing that some of the district court's discussion is mistaken, or overcome by proffered amendments to the class definition, they express concern that some of the discussion might imperil certification on remand of any other claim that we might reinstate on appeal—which is just what we are doing. Conversely, TJX (although for intricate reasons not Fifth Third) appears to agree that the district court's denial of certification is mooted by plaintiffs' failure to appeal it; but defendants themselves urge that—should we reinstate any of the dismissed claims—we "affirm" the denial of certification and "conclude that it precluded class certification of any revived claims(s)." In other words, both sides suggest that we resolve, although in opposite ways, a question not reached by the district court. The district court's resolution of the certification issue before it—not to certify the negligent misrepresentation claim—turned primarily on its conclusion that that claim required proof of individual reliance on the misrepresentation—directly so for the tort claim and at least indirectly so for the chapter 93A claim. On this basis, the district court found that class issues would not predominate over individual-party issues, defeating the only Rule 23(b) precondition that the court deemed viable. It is not clear to us whether a chapter 93A claim based on an unfairness theory would necessarily raise the same problem or be barred on the same basis. The unfairness theory appears to look to what the defendants did (or failed to do) rather than on the banks' reliance on supposed misrepresentations; but the district court's discussion of proof of causation of loss as a separate individual-party issue may (or may not) apply to unfairness claims as well. Neither side has briefed this issue and obviously the district court has not decided it. The district court also expressed concern about whether the putative class was properly defined by plaintiffs and about whether plaintiffs could provide fair and adequate representation, also a precondition for class status. Fed R. Civ. P. 23(a)(4). But the former concern might *501 perhaps be cured by the proffered amendments; and the latter directly related to the claims against Fifth Third and the conflicting economic interests of banks that are both issuers and acquirers; claims against TJX might be unaffected. The district court showed an enviable mastery of class action law and analysis, and the wisest course is to let it decide in the first instance whether the chapter 93A unfairness theory merits class status. To pick apart an integrated analysis and comment on specific reasons, as plaintiffs urge, would be unsound; it would be even more unsound to decide, as defendants urge, the class status of the revived claim unless and until the district court considers the issue and it is properly briefed to us. Transfer. Having denied certification, the district court concluded that the case could not proceed in federal court, partly because too little was at stake for the individual plaintiffs but primarily because ordinary diversity is lacking once the minimal diversity provided for a qualified class action fails. Defendants attack, and plaintiffs defend, the transfer order — authority to transfer being "a legal question we review de novo." Mills v. Maine, 118 F.3d 37, 51 (1st Cir.1997) (citation omitted). Mills squarely decided "that, in the absence of any specialized state statute, `it is the duty of the trial court, if it finds that jurisdiction does not exist, to proceed no further but to dismiss the suit.'" Id. at 52 (emphasis in original) (quoting Joy v. Hague, 175 F.2d 395, 396 (1st Cir.1949)). Most of Mills' reasoning would apply even if there were a Massachusetts statute authorizing such a transfer, compare Weaver v. Marine Bank, 683 F.2d 744 (3rd Cir. 1982); anyway, no such statute is invoked. Mills' ruling on transfers to state courts was not, as has been suggested, merely dictum. In Mills, the district court had refused to transfer to state court a suit that fell outside its own subject matter jurisdiction and on appeal appellants insisted that the district court should have transferred the case to state court. This court then considered the claim and decided that the district court had no authority to make such a transfer. This holding binds district courts and, indeed, this panel. Muskat v. United States, 554 F.3d 183, 189 (1st Cir.2009). In ordering transfer, the district court said that its prior merits rulings were "`without prejudice' to reexamination in the courts of the Commonwealth." TJX says that this too was error. The "without prejudice" label has different meanings in different contexts, e.g., In re Sonus Networks, Inc., 499 F.3d 47, 60 n. 6 (1st Cir.2007); perhaps the district judge meant only that a transferee court can revisit its prior rulings in the same case. Rio Mar Assocs., LP v. UHS of P.R., Inc., 522 F.3d 159, 167 (1st Cir.2008). It would be quite another matter to decide a merits issue but then purport to deprive the decision of res judicata effect in future cases — a matter governed by established rules. E.g., Ramallo Bros. Printing, Inc. v. El Dia, Inc., 490 F.3d 86 (1st Cir.2007). But the "without prejudice" gloss here was commentary incident to the transfer order and, as we are vacating that order and remanding the case, we treat the characterization as falling with the order. Accordingly, we affirm (1) the district court's dismissal of the negligence and breach of contract claims, (2) its denial of the motion to amend the complaint, and (3) its sustaining of the negligent misrepresentation claim (and use as a theory under chapter 93A, but without prejudice to a motion by defendants for summary judgment), but we vacate (4) its dismissal of the chapter 93A claim based on the unfairness *502 theory and (5) its transfer order and no-prejudice ruling, and we remand for further proceedings consistent with this decision. Each party will bear its own costs on the appeal. It is so ordered. NOTES [1] The suit against TJX included other named plaintiffs who have since settled. A second AmeriFirst suit, with another named plaintiff (SELCO—a credit union in Oregon), was filed against Fifth Third in the district court. The two cases were consolidated and, as allegations against Fifth Third in the second suit mirror those in the first, we refer only to "the complaint." [2] The possible exception is that the complaint alleges that Fifth Third is a member of an organization that promotes security measures and is so listed on its website and that, in context, this amounts to an affirmative representation of compliance with various standards; but it is not apparent that the website contains the missing affirmative representations implied by the complaint, and plaintiffs' brief to us does not rely on this allegation in defending the claim but rather on the conduct theory just noted. [3] M.G.L. ch. 93A § 2 ("It is the intent of the legislature that in construing paragraph (a) of this section ... courts will be guided by the interpretations given by the [FTC] and the Federal Courts to section 5(a)(1) of the [FTCA]."), as well as case law, see PMP Associates, Inc. v. Globe Newspaper Co., 366 Mass. 593, 595, 321 N.E.2d 915 (1975) (Chapter 93A "directs us to consider the interpretations of unfair acts and practices under s.5 of the Federal Trade Commission Act...."). [4] Datacomm Interface, Inc. v. Computerworld, Inc., 396 Mass. 760, 778, 489 N.E.2d 185 (1986) (quoting PMP Assocs., Inc. v. Globe Newspaper Co., 366 Mass. 593, 596, 321 N.E.2d 915 (1975)). The FTC adopted the factors in a general statement, 29 Fed. Reg. 8325, 8355 (1964), noted approvingly in FTC v. Sperry & Hutchison Co., 405 U.S. 233, 244, 92 S.Ct. 898, 31 L.Ed.2d 170 (1972). [5] See Briggs v. Carol Cars, Inc., 407 Mass. 391, 396-97, 553 N.E.2d 930 (1990) ("We also reject the argument that the judge erred in concluding that the defendant's representation was recklessly made. It is enough that the judge found on adequate evidence that the defects in the vehicle were readily ascertainable by the defendant. If a statement of fact which is susceptible of knowledge is made as of one's knowledge and is false, it may be the basis of an action for deceit"); Pietrazak v. McDermott, 341 Mass. 107, 109-10, 167 N.E.2d 166 (1960). See also Kozdras v. Land/Vest Properties, Inc., 382 Mass. 34, 43, 413 N.E.2d 1105 (1980); Glickman v. Brown, 21 Mass.App.Ct. 229, 235, 486 N.E.2d 737 (1985). [6] See Erwin Chemerinsky, Federal Jurisdiction § 5.2, at 289-95 (5th ed.2007); Grable & Sons Metal Prod., Inc. v. Darue Engineering & Mfg., 545 U.S. 308, 315, 125 S.Ct. 2363, 162 L.Ed.2d 257 (2005); Cambridge Literary Prop., Ltd. v. W. Goebel Porzellanfabrik G.m.b., 510 F.3d 77, 95-96 (1st Cir.2007); PCS 2000 LP v. Romulus Telecomm., Inc., 148 F.3d 32, 35 (1st Cir. 1998). [7] Compare John G. Danielson, Inc. v. Winchester-Conant Props., Inc., 186 F.Supp.2d 1, 28 (D.Mass.2002), with Discover Realty Corp. v. David, 2003 Mass.App. Div. 172, 175 (2003).