Opinion
EDCV 23-2092 JGB (KKx)
02-29-2024
B.K. et al. v. EISENHOWER MEDICAL CENTER, et al.
Yana A. Hart, Ryan J. Clarkson, Tiara Avaness, Valter Malkhasyan, Clarkson Law Firm, P.C., Malibu, CA, John R. Parker, Jr., Almeida Law Group LLC, Sacramento, CA, for B.K. et al. Dyanne J. Cho, Alexander Vitruk, Teresa C. Chow, Baker and Hostetler LLP, Los Angeles, CA, Paul G. Karlsgodt, Pro Hac Vice, Baker and Hostetler LLP, Denver, CO, for Eisenhower Medical Center, et al.
Yana A. Hart, Ryan J. Clarkson, Tiara Avaness, Valter Malkhasyan, Clarkson Law Firm, P.C., Malibu, CA, John R. Parker, Jr., Almeida Law Group LLC, Sacramento, CA, for B.K. et al.
Dyanne J. Cho, Alexander Vitruk, Teresa C. Chow, Baker and Hostetler LLP, Los Angeles, CA, Paul G. Karlsgodt, Pro Hac Vice, Baker and Hostetler LLP, Denver, CO, for Eisenhower Medical Center, et al.
Proceedings: Order (1) GRANTING Defendant's Motion to Dismiss (Dkt. No. 18); and (2) VACATING the March 4, 2024 Hearing (IN CHAMBERS)
JESUS G. BERNAL, UNITED STATES DISTRICT JUDGE.
Before the Court is defendant Eisenhower Medical Center's ("Eisenhower" or "Defendant") motion to dismiss pursuant to Federal Rules of Civil Procedure 12(b)(6). ("Motion," Dkt. No. 18.) The Court determines this matter appropriate for resolution without a hearing. See Fed. R. Civ. P. 78; L.R. 7-15. After considering the papers filed in support of and in opposition to the Motion, the Court GRANTS the Motion. The Court VACATES the March 4, 2024 hearing.
I. BACKGROUND
On October 12, 2023, plaintiffs B.K. and N.Z., (collectively, "Plaintiffs") individually, and on behalf of all others similarly situated, filed a complaint against Defendant. ("Complaint," Dkt. No. 1.) The Complaint alleges fourteen causes of action: (1) violation of California Confidentiality of Medical Information Act, Cal. Civ. Code § 56, et seq. ("CMIA"); (2) violation of Electronic Communications Privacy Act, 18 U.S.C. § 2511(1), et seq. ("ECPA"); (3) violation of ECPA, 18 U.S.C. § 2511(3)(a), et seq.; (4) violation of California Invasion of Privacy Act, Cal. Penal Code § 630, et seq. ("CIPA"); (5) violation of California Unfair Competition law, Cal. Bus. & Prof. Code, § 17200, et seq. ("UCL"); (6) invasion of privacy under California constitution; (7) invasion of privacy — intrusion upon seclusion; (8) breach of implied contract; (9) violation of California Consumers Legal Remedies Act, Cal. Civ. Code § 1750, et seq. ("CLRA"); (10) violation of California Penal Code § 496(a) and (c); (11) negligence; (12) breach of confidence; (13) breach of fiduciary duty; and (14) unjust enrichment. (See Complaint.)
On December 15, 2023, Defendant moved to dismiss the Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). (See Motion.) On January 15,
All subsequent references to "Rule" refer to the Federal Rules of Civil Procedure, unless otherwise noted.
2024, Plaintiffs opposed the Motion. ("Opposition," Dkt. No. 20.) In support, Plaintiffs filed the declaration of Yana Hart. ("Hart Declaration," Dkt. No. 21.) On January 22, 2024, Plaintiffs filed a notice of supplemental authority. (Dkt. No. 22.) On February 5, 2024, Defendant replied. ("Reply," Dkt. No. 24.) On February 28, 2024, Plaintiffs filed a notice of supplemental authority. (Dkt. No. 27.)
Throughout their Opposition, Plaintiffs use LEXIS, rather than Westlaw for their legal citations. (See Opposition.) The Court's Standing Order instructs litigants to cite to Westlaw rather than Lexis. The Court admonishes Plaintiffs for failing to comply with the Court's Standing Order and orders them to comply in the future. (See Dkt. No. 10 § 9(b).)
II. FACTUAL ALLEGATIONS
Plaintiffs allege the following facts, which are assumed to be true for the purposes of this Motion. See Am. Fam. Ass'n, Inc. v. City & Cnty. of San Francisco, 277 F.3d 1114, 1120 (9th Cir. 2002).
Defendant is a nonprofit healthcare organization that maintains the public website https://www.eisenhowerhealth.org ("Website"). (Complaint ¶¶ 5-6.) Defendant has failed to implement adequate and reasonable measures to ensure that the website visitors and users' ("Users") personally identifiable information ("PII") and protected health information ("PHI") (collectively, "Private Information") was safeguarded. (Id. ¶ 6.) Defendant allowed unauthorized third parties, including Meta Platforms, Inc. d/b/a Facebook ("Meta") to intercept the Users' clicks, communications on, and visits of Defendant's website. (Id.) Unbeknownst to Users and without Users' authorization or informed consent, Defendant installed third-party analytics tools called the Meta Pixel and Conversions API ("CAPI") (collectively, the "Pixels") and other third-party tracking technology on its Website. (Id. ¶ 7.) The Pixels are snippets of code that track Users as they navigate through a website. (Id. ¶ 8.) The Pixels collect Users' confidential and private PHI—including but not limited to details about their medical conditions, treatments and providers sought, and appointments —and send it to Meta without prior, informed consent. (Id.)
Although Plaintiffs refer to "Facebook" in their Complaint, in the interest of consistency and accuracy, the Court uses the name "Meta" to refer to both "Facebook" and "Meta."
Defendant encouraged Plaintiffs to access and use various digital tools via its Website to receive healthcare services. (Id. ¶ 10.) In exchange for installing the Pixels, Meta provides Defendant with analytics about the advertisements it has placed as well as tools to target people who have visited its Website. (Id. ¶ 11.) The Pixels can track and log each page a user visits and the use of Pixels on the Website tracks PHI. (Id. ¶¶ 13-14.)
Defendant's Privacy Policy ("Privacy Policy") states:
We are committed to protecting the privacy of your medical information. We are required by law to maintain the confidentiality of information that identifies you and the care you receive. We ensure, to the best of our ability, that our systems are secure so as to protect your personal information from misuse. For example, like many web sites, we use cookies, log files and links to tell us how you use our site, but we do not collect or store personally identifiable information.
(Id. ¶ 105.)
Plaintiffs have been patients at Eisenhower
Both Plaintiffs—B.K. and N.Z.—allege nearly identical facts in the Complaint. (See Complaint ¶¶ 171-190.) The only notable differences are that B.K. used the Website for her knee condition and N.Z. used the Website for herself and her husband. (Id.) As such, the Court will refer to the Plaintiffs' allegations as one unless otherwise noted.
for over eight years and have been using the Website for over three years. (Id. ¶¶ 171, 181.) Plaintiffs started to receive unsolicited advertisements on their Facebook accounts relating to their medical conditions shortly after visiting the Website. (Id.) Plaintiffs used a feature on the Website called "MyChart" ("Patient Portal") which allows users to access their medical records online and to communicate with Defendant's providers online. (Id. ¶ 172.) While using the Website, Plaintiffs communicated sensitive personal and medical information to Defendant. (Id. ¶ 173.) Plaintiffs used the Website to research healthcare providers and communicate with them, research particular medical concerns and treatments, fill out forms and questionnaires, schedule and attend appointments, and perform other tasks related to specific medical inquiries and treatment. (Id. ¶ 174.) Plaintiffs also used the Patient Portal to refill prescriptions, look at bills and payments, and to see test results and notes from appointments. (Id. ¶ 175.)
Plaintiffs allege that as a result of the Pixels Defendant chose to install on its Website, Plaintiffs' information was "intercepted, viewed analyzed, and used by unauthorized third parties." (Id. ¶ 176.) Plaintiffs have used and continue to use the same devices to maintain and to access active Facebook accounts through the relevant period in this case. (Id. ¶ 178.) Plaintiffs reasonably expected that their online communications were solely between Plaintiffs and Defendant, and relied on Defendant's Privacy Policy in expecting Defendant would safeguard their Private Information. (Id. ¶ 179.) But for their status as Defendant's patients and Defendant's representations via its Privacy Policy, Plaintiffs would not have disclosed Private Information to Defendant. (Id.)
III. LEGAL STANDARD
A. Rule 12(b)(6)
Under Rule 12(b)(6), a party may bring a motion to dismiss for failure to state a claim upon which relief can be granted. Rule 12(b)(6) must be read in conjunction with Rule 8(a), which requires a "short and plain statement of the claim showing that a pleader is entitled to relief," in order to give the defendant "fair notice of what the claim is and the grounds upon which it rests." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007); see Ileto v. Glock Inc., 349 F.3d 1191, 1199-1200 (9th Cir. 2003). When evaluating a Rule 12(b)(6) motion, a court must accept all material allegations in the complaint —as well as any reasonable inferences to be drawn from them—as true and construe them in the light most favorable to the non-moving party. See Doe v. United States, 419 F.3d 1058, 1062 (9th Cir. 2005); ARC Ecology v. U.S. Dep't of Air Force, 411 F.3d 1092, 1096 (9th Cir. 2005); Moyo v. Gomez, 32 F.3d 1382, 1384 (9th Cir. 1994). Courts are not required, however, "to accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences." In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (internal citation and quotation omitted). Courts also need not accept as true allegations that contradict facts which may be judicially noticed. See Mullis v. U.S. Bankr. Court, 828 F.2d 1385, 1388 (9th Cir. 1987).
"While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the 'grounds' of his 'entitlement to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly, 550 U.S. at 555, 127 S.Ct. 1955 (citations omitted). Rather, the
allegations in the complaint "must be enough to raise a right to relief above the speculative level." Id.
To survive a motion to dismiss, a plaintiff must allege "enough facts to state a claim to relief that is plausible on its face." Id. at 570, 127 S.Ct. 1955; Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). "The plausibility standard is not akin to a 'probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully. Where a complaint pleads facts that are 'merely consistent with' a defendant's liability, it stops short of the line between possibility and plausibility of 'entitlement to relief.'" Iqbal, 556 U.S. at 678, 129 S.Ct. 1937 (quoting Twombly, 550 U.S. at 556, 127 S.Ct. 1955). The Ninth Circuit has clarified that (1) a complaint must "contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively," and (2) "the factual allegations that are taken as true must plausibly suggest an entitlement to relief, such that it is not unfair to require the opposing party to be subjected to the expense of discovery and continued litigation." Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011).
B. Rule 15
Rule 15 provides that leave to amend "shall be freely given when justice so requires." Fed. R. Civ. P. 15(a). The Ninth Circuit has held that "'[t]his policy is to be applied with extreme liberality.'" Eminence Cap., L.L.C. v. Aspeon, Inc., 316 F.3d 1048, 1051 (9th Cir. 2003) (quoting Owens v. Kaiser Found. Health Plan, Inc., 244 F.3d 708, 712 (9th Cir. 2001)). Generally, a "district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by allegation of other facts." Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (citation omitted).
IV. DISCUSSION
Plaintiffs bring fourteen causes of action. (See Complaint.) Plaintiffs assert the following: (1) violation of CMIA; (2) violation of ECPA; (3) violation of ECPA, 18 U.S.C. § 2511(3)(a), et seq.; (4) violation of CIPA; (5) violation of UCL; (6) invasion of privacy under California constitution; (7) invasion of privacy — intrusion upon seclusion; (8) breach of implied contract; (9) violation of CLRA; (10) violation of California Penal Code § 496(a) and (c); (11) negligence; (12) breach of confidence; (13) breach of fiduciary duty; and (14) unjust enrichment. (See Complaint.) Defendant moves to dismiss all claims for failure to state a claim under Rule 12(b)(6). (See Motion at 2.)
A. Claim One: CMIA
Defendant argues that Plaintiffs' CMIA claim should be dismissed because (1) Plaintiffs fail to plead facts showing any medical information or medical records have been transmitted; and (2) Plaintiffs fail to allege facts showing that anyone at any third party actually improperly viewed or accessed any medical information. (Motion at 13-14.)
Plaintiffs allege violations of three provisions of the CMIA: Section 56.10, which prohibits disclosure of medical information without prior authorization; Section 56.101, which penalizes negligently maintaining or storing medical information; and Section 56.36(b), which prohibits the negligent release of confidential information or records. (Complaint ¶¶ 213-224); Cal. Civ. Code §§ 56.10(a), 56.101(a), 56.36(b).
Section 56.10 states, "A provider of health care, health care service plan, or contractor shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization." Cal. Civ. Code
§ 56.10 (emphasis added). "Disclosure" in this context "refers to affirmative communicative acts—giving out medical information on a patient." Sutter Health v. Superior Court, 227 Cal.App.4th 1546, 174 Cal. Rptr. 3d 653 (2014); see Regents of Univ. of California v. Superior Ct., 220 Cal. App.4th 549, 163 Cal. Rptr. 3d 205 (2013), as modified on denial of reh'g (Nov. 13, 2013) ("Disclose" ... is an active verb, denoting in the context of CMIA and the protections afforded confidential medical information an affirmative act of communication.").
Here, Plaintiffs allege that Defendant violated Section 56.10 because they knowingly, willfully, or negligently disclosed Plaintiffs' medical information to Meta, allowing Meta to now advertise and target Plaintiffs. (Complaint ¶ 218.) Plaintiffs allege that they started to receive unsolicited advertisements on their Facebook accounts relating to their medical conditions shortly after visiting the Website. (Id. ¶¶ 171, 181.) However, Plaintiffs fail to allege what, if any, medical information or medical records were transmitted or disclosed. Notably, Plaintiffs' Complaint is 90 pages long but includes less than four pages of vague allegations about Plaintiffs and their experiences with Defendant. (See Complaint.) The Complaint is replete with conjectures and hypothetical scenarios and patients. (Id. ¶¶ 50-57; 74-96.) Plaintiffs fail to allege any specificity as to what medical information was allegedly disclosed or when it was disclosed. B.K. states she started using the Website over three years ago and started receiving unsolicited ads "shortly after" but provides no more information about the alleged disclosures. (Id. ¶ 171.) N.Z. alleges the same pattern but states that it occurred "over seven years ago." (Id. ¶ 181.) Accordingly, Plaintiffs' claim under Section 56.10 fails.
Section 56.101 penalizes those who negligently maintain or store medical information. Cal. Civ. Code § 56.101. A plaintiff must allege that a defendant's "negligence result[ed] in unauthorized or wrongful access to the information," i.e. that the information was "improperly viewed or otherwise accessed." In re Ambry Genetics Data Breach Litigation, 567 F. Supp. 3d 1130, 1148 (C.D. Cal. 2021) (citing Regents, 163 Cal. Rptr. 3d 205; see Sutter Health, 174 Cal. Rptr. 3d 653 ("No breach of confidentiality takes place until an unauthorized person views the medical information.")); see also Stasi v. Inmediata Health Group Corporation, 501 F. Supp. 3d 898, 922-23 (S.D. Cal. 2020). Under Section 56.36, an individual may bring an action for damages against an entity that has negligently released confidential information or records. In re Ambry, 567 F. Supp. 3d at 1148. Defendant argues that this claim fails because Plaintiffs do not allege facts showing anyone improperly viewed or accessed any medical information. (Motion at 13-14.) The Court agrees. Plaintiffs' sole allegation related to this claim states: "As a result of the Meta Pixel Defendant chose to install on its [Website], this [information regarding [] appointments, treatments, medications, and clinical information, including [] surgeries, lab work, and scans] was intercepted, viewed analyzed, and used by unauthorized third parties." (Complaint ¶ 176.) This vague assertion—coupled with Plaintiffs' lack of specificity as to the alleged medical records themselves, discussed above—is not enough to make out a claim for negligent maintenance of medical information. The Court finds that Plaintiffs fail to state a claim based on Sections 56.101(a) and 56.36(b) of the CMIA. Accordingly, the Court DISMISSES Claim One WITH LEAVE TO AMEND.
B. Claims Two, Three and Four: ECPA and CIPA
An ECPA claim requires a showing that the defendant (1) intentionally (2) intercepted,
endeavored to intercept or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication, (5) using a device. 18 U.S.C. §§ 2510 et seq. Similarly, CIPA prohibits any person from using electronic means to "learn the contents or meaning" of any "communication" "without consent" or in an "unauthorized manner." Cal. Pen. Code § 631(a). Under both the ECPA and CIPA, "[i]t shall not be unlawful... for a person ... to intercept a[n] electronic communication where such person is a party to the communication," so long as such interception is not "for the purpose of committing any criminal or tortious act" ("party exception"). 18 U.S.C. § 2511(2)(d); see In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 607 (9th Cir. 2020) ("Both [the ECPA and CIPA] contain an exemption from liability for a person who is a 'party' to the communication, whether acting under the color of law or not.") (citing 18 U.S.C. §§ 2511(2)(c), (d); Warden v. Kahn, 99 Cal. App.3d 805, 160 Cal. Rptr. 471 (1979)). "Courts perform the same analysis for both the [ECPA] and CIPA regarding the party exemption." In re Facebook, 956 F.3d at 607.
Here, Defendant argues that they were a party to (and intended recipient of) Plaintiffs' alleged communications on the Website and concludes that Plaintiffs' claims fail as a result. (Motion at 17.) Plaintiffs argue that the party exception is inapplicable because "Defendant's wiretapping was conducted with criminal and/or tortious intent." (Opposition at 7.) It is clear from Plaintiffs' Complaint that Defendant was a party to Plaintiffs' Website communications, and Plaintiffs do not dispute this contention. (See Complaint.) Because Defendant was the party that was meant to, and did, receive Plaintiffs' communications on the Website, under the party exception, "any alleged interception of the communications is not actionable." Pena v. GameStop, Inc., 670 F.Supp.3d 1112, 1118 (S.D. Cal. 2023). The issue then becomes whether the alleged conduct was conducted with criminal and/or tortious intent under the statute, such that it would qualify for the exception that renders the party exception inapplicable. Various courts have held that a plaintiff must plead sufficient facts to support an inference that the offender intercepted the communication for the purpose of a tortious or criminal act that is independent of the intentional act of recording or interception itself. Pena, 670 F.Supp.3d at 1119 (citing In re Google Cookie Placement Consumer Privacy Litigation, 806 F.3d 125, 145 (3d Cir. 2015)); see Caro v. Weintraub, 618 F.3d 94, 100 (2d Cir. 2010).
While Plaintiffs allege that Defendant engaged in the allegedly illegal interception of their and the proposed class members' information "for Defendant's commercial advantage," Plaintiffs do not allege that this purpose constitutes independently illegal or actionable conduct such that the party exception is inapplicable. (Complaint ¶ 245); see Pena, 670 F.Supp.3d at 1119-20. Accordingly, the Court finds that (1) the "criminal or tortious act" exception to the party exception is inapplicable to Plaintiffs' ECPA and CIPA claims, (2) the party exception to Plaintiffs' ECPA and CIPA claims exempts Defendants from liability, and (3) Plaintiffs fail to state a claim for violation of either statute. The Court
Plaintiffs briefly argue that their allegations under 18 U.S.C. §§ 2511(a)(c) & (d) provide an alternative bases of liability in which the party exception does not apply. (Opposition at 8.) "Instead, sub-sections (c) and (d) provide for liability for disclosure or use of intercepted communications regardless of who intercepts the communications." (Id.) Because the Court finds that Plaintiffs do not sufficiently allege that Defendant disclosed their information, the Court rejects this argument.
DISMISSES Claim Two, Claim Three, and Claim Four WITHOUT LEAVE TO AMEND.
C. Claim Five: UCL
Defendant moves to dismiss Claim Five on the grounds that (1) Plaintiffs have failed to state facts showing their PHI was disclosed to any third party, and (2) Plaintiffs have failed to state facts showing how Defendant's actions (or inactions) caused them any loss of money or property. (Motion at 22.)
A UCL claim may only be brought by "a person who has suffered injury in fact and has lost money or property as a result of the unfair competition." Cal. Bus. & Prof. Code § 17204. Plaintiffs, therefore, must "demonstrate some form of economic injury," such as surrendering more or acquiring less in a transaction, having a present or future property interest diminished, being deprived of money or property, or entering into a transaction costing money or property that would otherwise have been unnecessary. Kwikset Corp. v. Superior Court, 51 Cal.4th 310, 120 Cal. Rptr. 3d 741, 246 P.3d 877 (2011).
As discussed above, Plaintiffs fail to allege sufficient facts to show that Defendant disclosed Plaintiffs' information. Without more detailed allegations as to what "private information" was disclosed, how, and when it was disclosed, Plaintiffs' UCL claim fails. While this is a sufficient basis to dismiss Claim Five, in the interest of judicial economy, the Court addresses the loss of money requirement below.
Plaintiffs argue that they have sufficiently alleged harm under the UCL based on (1) loss of benefit of the bargain and (2) diminution in value of their PHI. (Opposition at 14; see Complaint ¶¶ 19, 306-307.) While Plaintiffs state in their Opposition that they allege harm under a theory of benefit of the bargain, their Complaint does not include these allegations as to the UCL claim. (See Complaint ¶¶ 306-307.)
Courts in this circuit have dismissed cases where, like here, the injury is based on "the loss of the inherent value of their personal data," as well as where it was undisputed that plaintiffs paid no money to the defendant. Doe v. Meta Platforms, Inc., 690 F.Supp.3d 1064, 1089 (N.D. Cal. Sept. 7, 2023) (citing In re Facebook, Inc., Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767, 804 (N.D.Cal. 2019) (noting "the plaintiffs here do not allege that they paid any premiums (or any money at all) to Facebook to potentially give rise to standing under California law" for purposes of UCL claim and dismissing claim for failure to allege "lost money or property")); see Cottle v. Plaid Inc., 536 F. Supp. 3d 461, 484 (N.D. Cal. 2021); see also Wesch v. Yodlee, Inc., 2021 WL 1399291, at *6 (N.D. Cal. Feb. 16, 2021) (holding that the plaintiffs had not alleged that they "surrender[ed] more or acquir[ed] less in a transaction than they otherwise would have" for purposes of UCL standing where they had not paid money to the defendant).
The Court finds that Plaintiffs do not sufficiently allege facts to state a UCL claim. Accordingly, the Court DISMISSES Claim Five WITH LEAVE TO AMEND.
D. Claims Six and Seven: Privacy Claims
To state a claim for invasion of privacy, "Plaintiffs must show that (1) they possess a legally protected privacy interest,
(2) they maintain a reasonable expectation of privacy, and (3) the intrusion is "so serious ... as to constitute an egregious breach of the social norms" such that the breach is "highly offensive." In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d at 601. "Determining whether a defendant's actions were 'highly offensive to a reasonable person' requires a holistic consideration of factors such as the likelihood of serious harm to the victim, the degree and setting of the intrusion, the intruder's motives and objectives, and whether countervailing interests or social norms render the intrusion inoffensive." Id. at 606.
Defendants move to dismiss Plaintiffs' privacy claims on the grounds that there is no serious invasion of privacy alleged. (Motion at 23.) Plaintiffs rely on In re Ambry, in which the court found that plaintiffs had adequately alleged an invasion of privacy claim. (Opposition at 16.) In re Ambry reasoned that "[c]ourts have refused to dismiss invasion of privacy claims at the motion to dismiss stage where, as here, a data breach involved medical information, because the disclosure of such information is more likely to constitute an 'egregious breach of the social norms' that is 'highly offensive.'" In re Ambry, 567 F. Supp. 3d at 1143. As the Court has already discussed above, Plaintiffs do not sufficiently plead that Defendant disclosed Plaintiffs' medical information. As the Complaint is pled, the Court can only interpret that Plaintiffs used Defendant's Website for routine medical searches and inquiries. Because Plaintiffs fail to plead that any medical information was disclosed, Plaintiffs claims do not rise to the level of an "egregious breach of the social norms" that is "highly offensive." Id.: see Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1025 (N.D. Cal. 2012) (finding that even disclosure of highly personal information such as social security numbers is not "highly offensive" enough to meet the "high bar for an invasion of privacy claim"). As such, the Court finds that Plaintiffs privacy claims fail. The Court DISMISSES Claim Six and Claim Seven WITH LEAVE TO AMEND.
E. Claim Eight: Implied Contract
"An implied-in-fact contract requires proof of the same elements necessary to evidence an express contract: mutual assent or offer and acceptance, consideration, legal capacity and lawful subject matter." Corona v. Sony Pictures Entm't, Inc., 2015 WL 3916744, at *5 (C.D. Cal. June 15, 2015). "An implied contract requires that both parties agree to its terms and have a 'meeting of the minds,' but the creation of an implied contract can be manifested by conduct rather than words." Castillo v. Seagate Tech., LLC, 2016 WL 9280242, at *8 (N.D. Cal. Sept. 14, 2016). Under California law, to state a cause of action for breach of contract a plaintiff must plead: "the contract, plaintiffs' performance (or excuse for nonperformance), defendant's breach, and damage to plaintiff therefrom." Gautier v. General Tel. Co., 234 Cal.App.2d 302, 44 Cal. Rptr. 404 (1965). California law requires a showing of "appreciable and actual damage" to assert a breach of contract claim. Aguilera v. Pirelli Armstrong Tire Corp., 223 F.3d 1010, 1015 (9th Cir. 2000). Nominal damages and speculative harm do not suffice to show legally cognizable damage under California contract law. Ruiz v. Gap, Inc., 622 F. Supp. 2d 908, 917 (N.D. Cal. 2009).
Here, Plaintiffs allege that they entered into an implied contract when they "provided their Private Information to Defendant in exchange for services," and that Defendant agreed to safeguard and not disclose such Private Information without consent. (Complaint ¶ 335.) The Complaint includes portions of the Defendant's Privacy Policy, which Plaintiffs allege
they relied on "in reasonably expecting [Defendant] would safeguard their Private Information." (Id. ¶¶ 179, 189.) Plaintiffs argue that there is (1) mutual assent based on Defendant's representations regarding the safeguarding of nondisclosure and acceptance through Plaintiffs' providing their Private Information, (2) consideration because Defendant affirmatively promised to keep users' Private Information secure and protected, and (3) damages including loss of value of their Private Information. (Opposition at 16-17; see Complaint ¶ 105.) The Court finds that Plaintiffs do not allege a cognizable theory of damages. The Court rejected Plaintiffs loss of value arguments above and does the same here with respect to Plaintiffs' contract claim.
A basic principle of contract law is that the "purpose of contract damages is to put a plaintiff in the same economic position he or she would have occupied had the contract been fully performed." Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1029 (N.D. Cal. 2012). Plaintiffs have not persuasively alleged that they "reasonably expect[ed] that they would be compensated for the 'value' of their personal information." Id. (citing In re Jetblue Airways Corp. Privacy Litigation, 379 F. Supp. 2d 299, 327 (E.D. N.Y. 2005)). Plaintiffs have not alleged that they, or any other Users, have been foreclosed from opportunities to capitalize on the value of their personal information. Accordingly, the Court DISMISSES Claim Eight WITH LEAVE TO AMEND.
F. Claim Nine: CLRA
The CLRA prohibits "unfair or deceptive acts or practices" in transactions for the sale or lease of goods or services to consumers. Cal. Civ. Code § 1770(a). Unlawful practices include "[r]epresenting that goods or services have ... characteristics... uses, benefits, or quantities that they do not have" and "[r]epresenting that goods or services are of a particular standard, quality, or grade ... if they are of another." Id. § 1770(a)(5), (a)(7). Similarly, the UCL prohibits "any unlawful, unfair or fraudulent business act or practice." Cal. Bus. & Prof. Code § 17200. Because the statute is written in the disjunctive, the UCL allows for separate theories of liability under the "unlawful," "unfair," and "fraudulent" prongs. See Hodsdon v. Mars, Inc., 891 F.3d 857, 865 (9th Cir. 2018); CelTech Commc'ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal.4th 163, 83 Cal.Rptr.2d 548, 973 P.2d 527, 540 (1999). Fraudulent omissions are actionable under both the CLRA and the UCL. See Daniel v. Ford Motor Co., 806 F.3d 1217, 1225 (9th Cir. 2015). To be actionable, an omission must be "contrary to a representation actually made by the defendant, or an omission of a fact the defendant was obliged to disclose." Hodsdon, 891 F.3d at 865 (quoting Daugherty v. Am. Honda Motor Co., 144 Cal.App.4th 824, 51 Cal. Rptr. 3d 118, 126 (2006)).
Here, Plaintiffs rely on a fraudulent omission theory of consumer fraud. (See Complaint ¶¶ 342-349.) Plaintiffs allege that "Defendant failed to disclose it secretly shared, used, and allowed third parties to intercept Plaintiffs' and Subclass Members' Private Information." (Id. ¶ 346.) Defendant argues that Plaintiffs' "vague allegations that [Defendant] allegedly made false representations" are insufficient to satisfy the pleading standard required by the CLRA. (Motion at 26). The Court agrees. As discussed above, Plaintiffs fail to sufficiently allege the underlying act that Defendant "secretly shared, used, and allowed third parties to intercept." (See Complaint ¶ 346.) Without this, the Court finds that Plaintiffs CLRA claim fails. The Court DISMISSES Claim Nine WITH LEAVE TO AMEND. G. Claim Ten: Larceny
California Penal Code Section 496(a) prohibits the obtaining of property "in any manner constituting theft." Cal. Penal Code § 496(a). Defendant argues that Plaintiffs' larceny claim should be dismissed because "Plaintiffs have not clearly identified the specific representations that Meta made to them that support their larceny claim." (Motion at 26.) Plaintiffs allege that Defendant stole Plaintiffs' personal information without Plaintiffs' consent. (Complaint ¶¶ 355-356.) Plaintiffs do not allege any specific facts related to stealing or theft of information. Because the Court has already found that Plaintiffs do not sufficiently plead facts to support the finding that Defendant disclosed Plaintiffs information, the Court finds that Plaintiffs' larceny claim fails. Accordingly, the Court DISMISSES Claim Ten WITH LEAVE TO AMEND.
H. Claim Eleven: Negligence
Plaintiffs argue that their negligence claim is sufficiently pleaded because they were injured "when their Private Information was wrongfully divulged and misused" and due to the loss of the value of their Private Information. (Opposition at 19.) The Court has already rejected both of these arguments above. Plaintiffs fail to persuade the Court to find differently as to their negligence claim. Accordingly, the Court DISMISSES Claim Eleven WITH LEAVE TO AMEND.
I. Claim Twelve: Breach of Confidence
Breach of confidence under California law "is based upon the concept of an implied obligation or contract between the parties that confidential information will not be disclosed." Ent. Rsch. Grp., Inc. v. Genesis Creative Grp., Inc., 122 F.3d 1211, 1226-27 (9th Cir. 1997). A plaintiff must allege "(1) the plaintiff conveyed 'confidential and novel information' to the defendant; (2) the defendant had knowledge that the information was being disclosed in confidence; (3) there was an understanding between the defendant and the plaintiff that the confidence be maintained; and (4) there was a disclosure or use in violation of the understanding." Id. at 1227. As discussed above, Plaintiffs fail to sufficiently allege disclosure. As a result, Plaintiffs' breach of confidence claim fails. The Court DISMISSES Claim Twelve WITH LEAVE TO AMEND.
J. Claim Thirteen: Fiduciary Duty
To allege breach of fiduciary duty, a plaintiff must show "(1) existence of a fiduciary duty; (2) breach of the fiduciary duty; and (3) damage proximately caused by the breach." Vaxiion Therapeutics, Inc. v. Foley & Lardner LLP, 593 F. Supp. 2d 1153, 1169 (S.D. Cal. 2008).
Here, Plaintiffs allege that Defendant breached its fiduciary duties to Plaintiffs by "disclosing their Private Information to unauthorized third parties, and separately, by failing to notify" Plaintiffs of this fact. (Complaint ¶ 391.) Defendant argues that Plaintiffs do not state facts showing that Defendant breached any duty, including the disclosure of any of Plaintiffs' medical information or the content of any confidential communications with their medical providers. (Motion at 29.) As discussed above, the Court finds that Plaintiffs do not sufficiently allege that Defendant disclosed their information. Moreover, Plaintiffs fail to respond to Defendant's argument in any way. Accordingly, the Court DISMISSES Claim Thirteen WITH LEAVE TO AMEND.
K. Claim Fourteen: Unjust Enrichment
Plaintiffs' unjust enrichment claim is premised on the same theories outlined above—Plaintiffs allege that "Defendant was unjustly enriched by receiving, disclosing,
and using Plaintiffs' Private Information without their consent." (Opposition at 20; Complaint ¶¶ 297-303.) Plaintiffs do not allege any facts that would lead the Court to find that Defendant was unjustly enriched. Above, the Court finds that Plaintiffs fail to plead facts showing that Defendant disclosed Plaintiffs information —Plaintiffs fail to persuade the Court that it should come to a different conclusion as to Claim Fourteen. Without specific allegations about the underlying information that was allegedly disclosed, it is unclear to the Court how, if at all, Defendant was unjustly enriched. Plaintiffs plead that "[i]t would be inequitable and unjust to permit Defendant to retain the enormous economic benefits (financial and otherwise) it has obtained from and/or at the expense of Plaintiffs and Class Members." (Complaint ¶ 401.) While Plaintiffs allege that "a complete health care record sells for $250 on average," the Complaint does not include facts specific to unjust enrichment of Defendant resulting from Plaintiffs' information. Accordingly, the Court DISMISSES Claim Fourteen with LEAVE TO AMEND.
V. CONCLUSION
For the above reasons, the Court ORDERS as follows:
1. Defendant's Motion is GRANTED.
2. Claims One, Five, Six, Seven, Eight, Nine, Ten, Eleven, Twelve, Thirteen, and Fourteen are DISMISSED WITH LEAVE TO AMEND.
3. Claims Two, Three, and Four are DISMISSED WITHOUT LEAVE TO AMEND.
4. Plaintiffs' Complaint is DISMISSED WITH LEAVE TO AMEND.
5. Plaintiffs may file an amended complaint no later than March 22, 2024.
6. The Court VACATES the March 4, 2024 hearing.
IT IS SO ORDERED.