A data breach case brought by several banks and federal credit unions against fast food chain Wendy's should proceed under the standards of Ohio law, a federal judge has recommended.

U.S. Chief Magistrate Judge Maureen P. Kelly of the Western District of Pennsylvania recommended that Ohio law govern the plaintiffs' claims of negligence per se but not the claims alleging violations of the Ohio Deceptive Trade Practices Act (ODTPA) as it applies to those plaintiffs not from Ohio.

The banks and credit unions are issuers of credit cards, and when their customers use those cards at Wendy's, the restaurant stores that data. In October 2015, hackers used the credentials of third-party vendors to install malware in the Wendy's system. They were able to steal card data of Wendy's customers from at least 1,000 restaurants, Kelly said in her report and recommendation.

The plaintiffs argued that Ohio law should apply because it is where Wendy's is headquartered. Wendy's, meanwhile, wanted to litigate each individual case using the law of the plaintiffs' respective home states.

Kelly said that the conduct at issue in the negligence claim involved Wendy's alleged failure to protect customer information and not the data breach itself.

“The instant suit is not based on the hacking incident itself, but rather on the actions and inactions of defendants in safeguarding payment card data which was compromised in the hacking incident,” Kelly said. “The court finds sufficient support for … plaintiffs' premise that the alleged actions and inactions of defendants at issue in this case took place at defendants' headquarters in Ohio. Accordingly, this critical factor weighs in favor of the application of Ohio law.”

Regarding the applicability of ODTPA, Kelly said in this case it was not the correct standard for out-of-state plaintiffs.

Unlike the negligence claim, “the outcome differs as to the ODTPA claim … due to the nature of the statute upon which it is based. As multiple courts have found, a single state's consumer protection statute, like the ODTPA, which is designed to protect consumer residents of the state in which it was promulgated, should not be generally applied to an action involving plaintiffs from multiple other states,” Kelly said.

She added that courts have held that the state where the consumer is harmed has the greatest interest in application of state consumer protection law.

Cassandra Johnson of Alston & Bird represents Wendy's and Arthur M. Murray of the Murray Law Firm represents the plaintiffs. Neither responded to a request for comment.