Credit Union National Association (CUNA) today filed a brief in the 2nd District Court of appeals calling for reversal of a district court’s decision on the validity of the Visa Global Compromised Account Recovery (GCAR) program.
The district court in Visa, Inc. v. Sally Beauty Holdings, Inc., held Visa’s assessment of damages through GCAR against Sally Beauty Supply for a data breach constituted an unenforceable penalty. A district court agreed, and CUNA’s brief states that invalidating the GCAR will place small financial institutions at risk of suffering losses without recompense.
“The repercussions should the decision stand—which it should not as a matter of law and policy—will seriously impact the functioning of the payment cards system, with the greatest burden falling on small institutions, like credit unions,” the brief reads.
Visa created the GCAR in 2012 and it applies to point-of-sale and ATM losses for Visa cards when a Visa merchant has violated, for example, certain data-security standards. It generally enables credit unions, as issuing financial institutions, to efficiently recover a portion of the damages incurred from a breach.