Evan Schuman's StorefrontBacktalk

Not that it was needed, but more proof materialized this month that substantial security investments are really hard to justify. TJX announced Sept. 2 what will likely be the last of the settlements of class action lawsuits against it from the data breach of its systems that began in 2005 and which impacted more than 100 million payment cards.

Given the absence of an ROI argument for security investments—after all, no one is truly going to argue that it could boost revenue or profits—the only reason to make such an investment is risk avoidance. But the way criminal and civil laws are created in the U.S., the risks are quite minimal for the large retail chains.

There are no federal, state, county or municipal criminal laws requiring companies to protect personal or payment card data properly. That means that, even if it’s established that a retailer did act recklessly with such data—and the evidence introduced at trial against TJX certainly made a good faith effort at establishing just that—no charges can be made against that chain.

That leaves civil courts. But civil courts are fundamentally focused on making someone financially whole. Thanks to zero liability programs from the card brands and many key issuing banks, consumers are generally unable to prove any material financial losses. That pretty much killed the consumer class-action lawsuit.

The only thing left was for the bankers themselves to sue. TJX made an excellent defense, namely that the bankers themselves chose to reissue their cards. Had they simply trusted card brand guidance and done nothing, they would have sustained few if any losses. TJX settled with almost all of the banks late December 2007.

Last Wednesday (Sept. 2), TJX struck quite a bargain and settled with the handful of remaining banks. In settling all charges with four different financial institutions—AmeriFirst Bank, HarborOne Credit Union, SELCO Community Credit Union and Trustco Bank—TJX agreed to pay $525,000 to be split between the four businesses.

Was that punitive or was that something closer to a nuisance payment for the $19 billion retail chain, operating under the brands of Marshalls, T.J. Maxx, HomeGoods, A.J. Wright, Winners, Stylesense and T.K. Maxx? (It sold Bob’s Stores to private investors last year.)