Reidentification Theory Doesn’t Save Privacy Lawsuit–Steinberg v. CVS Caremark

By Eric Goldman

Steinberg v. CVS Caremark Corp., 2012 WL 507807 (E.D. Pa. Feb. 16, 2012)

CVS Caremark provided consumer data to pharma companies and data brokers. The plaintiffs alleged that the data transfers violated CVS’s privacy policies, but CVS apparently disclosed only “de-identified” data as contemplated by HIPAA. Plaintiffs couldn’t sue under HIPAA, both because CVS complied with HIPAA and because HIPAA doesn’t enable a private cause of action for these violations. Although these facts implicate Sorrell v. IMS, that case didn’t come up because the plaintiffs didn’t sue under an analogous statute specifically pharmaceutical data transfers.

Instead, the plaintiffs sued under Pennsylvania’s consumer protection act, claiming that CVS made material misrepresentations in its privacy policies about its data handling. The court dismisses the suit–with prejudice!–on two principal grounds.

First, it says that CVS told the truth in its privacy policies:

The plaintiffs do not allege that the defendants disclose Protected Health Information to third parties. Rather, they disclose de-identified information, which (a) federal regulations do not prohibit; and (b) is consistent with the defendants’ statements that they safeguard information that “may identify” consumers.

To salvage the situation, the plaintiffs’ lawyer tried to argue that the de-identified information could be re-identified by recipients, but apparently the plaintiffs’ lawyer couldn’t make the argument very cogently:

Although they admit that the information the defendants disclose to third parties is de-identified within the meaning of HIPAA, the plaintiffs have argued that it can be “re-identified.” There is no such contention in the CAC, and plaintiffs’ counsel admitted that the basis for such an argument comes from a single journal article and would take the form of expert testimony that a re-identification risk exists with respect to de-identified information generally, not as to the plaintiffs in this case.

It seems pretty clear that the lawyer didn’t fully understand re-identification–at least, not well enough to explain how it might trump CVS’s privacy promises. Thus, the court never really gets to the merits of the re-identification theory, but clearly it did not pique the judge’s interest. Presumably the “single journal article” referenced is Paul Ohm’s Broken Promises of Privacy article. Looks like Paul missed out on a potentially lucrative expert gig.

Second, the court rejects the consumer protection claim on two different standing grounds:

1) the named plaintiff didn’t suffer any cognizable loss. The best the plaintiffs’ lawyer could do was claim “the loss of the value of his demographic information, or the loss of an opportunity to pay less for his prescriptions with the understanding that the defendants would be profiting from the sale of his information.” These types of losses have flopped repeatedly before, and they do so again (citing, among others, LaCourt, JetBlue and Low v. LinkedIn).

2) the named plaintiff didn’t allege justifiably reliance on CVS’s representations. To get around this specific requirement in Pennsylvania law, Plaintiffs tried to allege that CVS was a fiduciary; that goes nowhere.

The unjust enrichment claim fails because there was no expectation that the information provided to CVS would be compensated. The intrusion into seclusion claim fails because the plaintiffs voluntarily provided their data to CVS.

As we’ve already seen, privacy plaintiffs’ lawyers are avid readers of the privacy scholarly literature, looking for new theories to help them grind their axes. Privacy scholars should be gratified by this practitioner attention. As we know, most law review articles never get read (my mom won’t even read mine). As this case illustrates, privacy plaintiffs’ lawyers may build their entire cases around the academic literature. Personally, I think this fact means privacy scholars need to ensure that their articles are ready for the rough-and-tumble world of profit-seeking class action litigation. It would be irresponsible for a privacy scholar to toss out a half-baked academic thought about new ways of suing over privacy, knowing that the plaintiffs’ bar is looking for fresh meat–anything–to get past 12(b)(6) motions irrespective of the case’s true merit. I’m not accusing Paul Ohm’s article of being half-baked (far from it, it’s one of the most interesting articles I’ve read in years); but I couldn’t be as complimentary towards some of the other privacy scholarship I see, and I hope the thought of being potentially responsible for lots of wasted litigation activity will encourage all privacy scholars to honestly reflect on the social merits of their arguments.

Although the re-identification theory doesn’t go anywhere in this case, arguably CVS dodged a bullet. Ever since I read Paul’s paper, I have been recommending that companies stop making PII/non-PII distinctions in their privacy policies. It was instantly clear to me from reading Paul’s paper that plaintiffs could attack a privacy policy’s promise not to disclose “PII” using a reidentification theory because we don’t reliably know which bits of data can be used to uniquely identify individuals. Indeed, the language CVS used (it wouldn’t disclose information that “may identify” consumers) was especially dangerous, because any bit of information, in combination with the right set of other data, has the theoretical capacity to uniquely identify individuals. The plaintiffs’ lawyer in this case was sniffing around the issue but didn’t nail it; but other cases–especially after goofy rulings like Pineda treating zip codes as PII–will raise the issue better and pose significant danger to defendants. This case is a warning sign that CVS, and everyone else, should carefully reexamine the PII/non-PII distinctions in their privacy policies.