CUNA filed a brief in the Second District Court of Appeals for the Second Judicial District Friday calling for reversal of a state trial court’s decision on the validity of the Visa Global Compromised Account Recovery (GCAR) program.

The case Visa, Inc. v. Sally Beauty Holdings, Inc., held Visa’s assessment of damages through GCAR against Sally Beauty Supply for a data breach constitiuted an unenforceable penalty.  CUNA’s brief states that invalidating the GCAR will place small financial institutions at risk of suffering losses without recompense.

“The repercussions should the decision stand—which it should not as a matter of law and policy—will seriously impact the functioning of the payment cards system, with the greatest burden falling on small institutions, like credit unions,” the brief reads.

Visa created the GCAR in 2012 and it applies to point-of-sale and ATM losses for Visa cards when a Visa merchant has violated, for example, certain data-security standards. It generally enables credit unions, as issuing financial institutions, to efficiently recover a portion of the damages from a data breach.