South Carolina Cases August 16, 2024: Andrews v. Prisma Health

Case Description

1

OPINION AND ORDER

Jacquelyn D. Austin United States District Judge

This matter is before the Court on Defendant's motion to dismiss. [Doc. 15.] Plaintiff filed this putative class action on July 3, 2023. [Doc. 1.] On August 28, 2023, Defendant filed a motion to dismiss. [Doc. 15.] Plaintiff filed a response in opposition to the motion to dismiss on October 11, 2023 [Doc. 23], and Defendant filed a reply on November 7, 2023 [Doc. 32]. Plaintiff then filed a notice of filing supplemental authority on January 16, 2024 [Doc. 34], to which Defendant filed a response on February 20, 2024 [Doc. 39]. The Court held a hearing on the motion on April 30, 2024. [Doc. 46.] For the reasons below, the Court grants the motion.

BACKGROUND

Defendant is a private nonprofit health company and the largest health care provider in South Carolina. [Doc. 1 ¶¶ 37-38.] Defendant owns and controls www.prismahealth.org (the “Website”), “which it encourages patients to use for booking

2

medical appointments, locating physicians and treatment facilities, communicating medical symptoms, searching medical conditions and treatment options, signing up for events and classes, and more.” [ Id. ¶ 11.] Defendant represents to prospective and current patients that the Website is a secure and private means of interacting with it and its health providers, and places on the Website a Notice of Privacy Practices, which “specifically states that ‘[o]ther uses and disclosures of medical information not covered by this Notice or relevant laws will be made only with your written consent.'” [ Id. ¶ 12 (alteration in original) (quoting Prisma Health Notice of Privacy Practices).]

Plaintiff has been a patient of Defendant's since 2012 and has used the Website to communicate with Defendant on numerous occasions. [ Id. ¶ 106.] Unbeknownst to Plaintiff and other class members and without their consent, Defendant installed hidden source code on the Website, including the Facebook Tracking Pixel (the “Pixel”) and Facebook Conversions Application Programming Interface (“CAPI”), that redirect and disclose Plaintiff's and class members' confidential personally identifiable information (“PII”) and protected health information (“PHI”) (collectively, “Private Information”) to undisclosed third parties such as Meta Platforms, Inc. d/b/a Meta (“Facebook”). [ Id. ¶¶ 2, 12-13, 18-26, 31, 33, 52-54, 59-67, 69-73, 76-82, 90-100, 105, 112, 115, 118-22.] Facebook then uses the Private Information “to build profiles for the purposes of retargeting and future marketing,” which ultimately benefits Defendant by reducing advertising and retargeting costs. [ Id. ¶¶ 27, 162; see id. ¶¶ 28, 83, 86, 88.]

3

On July 3, 2023, Plaintiff filed this action on behalf of herself and all others similarly situated. [Doc. 1.] The Complaint alleges seven causes of action: invasion of privacy; breach of implied contract; unjust enrichment; breach of fiduciary duty; unauthorized interception, use, and disclosure in violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2511(1) et seq. (“ECPA”); breach of confidence; and negligence. [Doc. 1 ¶¶ 184-288.] For relief, Plaintiff seeks class certification; equitable relief enjoining Defendant from engaging in wrongful conduct pertaining to the misuse and/or disclosure of Plaintiff's and class members' Private Information; injunctive relief; damages; attorneys' fees, costs, and expenses; and prejudgment interest. [ Id. at 70.]

APPLICABLE LAW

Rule 12(b)(1) Standard

A challenge to standing “implicates this Court's subject matter jurisdiction and is governed by Rule 12(b)(1).” Crumbling v. Miyabi Murrells Inlet, LLC , 192 F.Supp.3d 640, 643 (D.S.C. 2016). Article III limits a federal court's jurisdiction to cases and controversies, and “[o]ne element of the case-or-controversy requirement is that plaintiffs must establish that they have standing to sue.” Clapper v. Amnesty Int'l USA , 568 U.S. 398, 408 (2013) (internal quotation marks omitted). To possess Article III standing, a “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins , 578 U.S. 330, 338 (2016). In a class action, courts “analyze standing based on the allegations of personal injury made by the named

4

plaintiffs.” Beck v. McDonald , 848 F.3d 262, 269 (4th Cir. 2017). Additionally, “[s]tanding is not dispensed in gross,” and instead, “a plaintiff must demonstrate standing for each claim he seeks to press and for each form of relief that is sought.” Davis v. Fed. Election Comm'n , 554 U.S. 724, 734 (2008) (internal quotation marks and citation omitted).

“The party attempting to invoke federal jurisdiction bears the burden of establishing standing.” Miller v. Brown , 462 F.3d 312, 316 (4th Cir. 2006). When ruling on a motion to dismiss for lack of standing, a court “must accept as true all material allegations of the complaint, and must construe the complaint in favor of the complaining party.” Warth v. Seldin , 422 U.S. 490, 501 (1975). “Nevertheless, the party invoking the jurisdiction of the court must include the necessary factual allegations in the pleading, or else the case must be dismissed for lack of standing.” Bishop v. Bartlett , 575 F.3d 419, 424 (4th Cir. 2009). “When a defendant raises standing as the basis for a motion under Rule 12(b)(1) . . . the district court may consider evidence outside the pleadings without converting the proceeding to one for summary judgment.” White Tail Park, Inc. v. Stroube , 413 F.3d 451, 459 (4th Cir. 2005) (internal quotation marks omitted). “A federal court is powerless to create its own jurisdiction by embellishing otherwise deficient allegations of standing.” Whitmore v. Arkansas , 495 U.S. 149, 155-56 (1990).

Rule 12(b)(6) Standard

Under Rule 12(b)(6) of the Federal Rules of Civil Procedure, a claim should be dismissed if it fails to state a claim upon which relief can be granted. When considering a motion to dismiss, the court should “accept as true all well-pleaded allegations and should view the complaint in a light most favorable to the plaintiff.” Mylan Lab'ys, Inc. v. Matkari , 7 F.3d 1130, 1134 (4th Cir. 1993). However, the court “need not accept the legal

5

conclusions drawn from the facts” nor “accept as true unwarranted inferences, unreasonable conclusions, or arguments.” E. Shore Mkts., Inc. v. J.D. Assocs. Ltd. P'ship , 213 F.3d 175, 180 (4th Cir. 2000). Further, for purposes of a Rule 12(b)(6) motion, a court may rely on only the complaint's allegations and those documents attached as exhibits or incorporated by reference. See Simons v. Montgomery Cnty. Police Officers , 762 F.2d 30, 31-32 (4th Cir. 1985). If matters outside the pleadings are presented to and not excluded by the court, the motion is treated as one for summary judgment under Rule 56 of the Federal Rules of Civil Procedure. Fed.R.Civ.P. 12(d).

With respect to well pleaded allegations, the United States Supreme Court explained the interplay between Rule 8(a) and Rule 12(b)(6) in Bell Atlantic Corp. v. Twombly :

Federal Rule of Civil Procedure 8(a)(2) requires only “a short and plain statement of the claim showing that the pleader is entitled to relief,” in order to “give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the “grounds” of his “entitle[ment] to relief” requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do. Factual allegations must be enough to raise a right to relief above the speculative level on the assumption that all the allegations in the complaint are true (even if doubtful in fact).

550 U.S. 544, 555 (2007) (footnote and citations omitted); see also 5 Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 1216, at 235-36 (3d ed. 2004) (“[T]he pleading must contain something more . . . than a bare averment that the pleader wants compensation and is entitled to it or a statement of facts that merely creates a suspicion that the pleader might have a legally cognizable right of action.”).

6

“A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal , 556 U.S. 662, 678 (2009). “The plausibility standard is not akin to a ‘probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id . The plausibility standard reflects the threshold requirement of Rule 8(a)(2)-the pleader must plead sufficient facts to show he is entitled to relief, not merely facts consistent with the defendant's liability. Twombly , 550 U.S. at 557; see also Iqbal , 556 U.S. at 678 (“Where a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief.” (internal quotation marks omitted)). Accordingly, the plausibility standard requires a plaintiff to articulate facts that, when accepted as true, demonstrate that the plaintiff has stated a claim that makes it plausible the plaintiff is entitled to relief. Francis v. Giacomelli , 588 F.3d 186, 193 (4th Cir. 2009).

DISCUSSION

Defendant argues that Plaintiff's Complaint should be dismissed for lack of subject matter jurisdiction because the Complaint fails to plead that Plaintiff suffered a concrete and traceable injury such that she has standing and, even if she has standing, the Complaint should be dismissed for failure to state a claim upon which relief can be granted. [Doc. 15-1.] The Court first addresses Defendant's arguments regarding standing. See Garey v. James S. Farrin, P.C., 35 F.4th 917, 921 (4th Cir. 2022) (“Because standing is a threshold jurisdictional question, we address it first.” (cleaned up)).

7

Standing

Defendant argues that Plaintiff lacks standing because the Complaint fails to plead an injury in fact that is specific to Plaintiff as opposed to a hypothetical patient of Defendant; Plaintiff does not plausibly plead a risk of future harm to constitute an injury in fact; Plaintiff's invasion of privacy injury allegations do not support standing; Plaintiff's overpayment theory of injury fails to support standing; and Plaintiff's diminished value theory of injury does not confer standing. [Doc. 15-1 at 3-10.] Based on these arguments, Defendant challenges only the first element of the standing analysis- whether Plaintiff suffered an injury in fact.

To establish the first element of standing, a plaintiff must show that he suffered an injury in fact that is “concrete and particularized” and “actual or imminent.” Lujan v. Defenders of Wildlife , 504 U.S. 555, 560 (1992) (internal quotation marks omitted). “The most obvious concrete injuries are tangible harms, such as physical harms and monetary harms. Intangible harms are trickier, but they too can be concrete.” O'Leary v. TrustedID, Inc. , 60 F.4th 240, 242 (4th Cir. 2023) (internal quotation marks and citation omitted).

In response to Defendant's motion, Plaintiff contends that she has pled an injury in fact by plausibly alleging injury to her privacy interests; that she has alleged other injuries sufficient for Article III standing, including the risk of future harm; that her invasion of privacy injury allegations are sufficient to support Article III standing; that she has standing because she was deprived of the benefit of her bargain; and that her diminished value theory of injury supports standing. [Doc. 23 at 6-13.] The Court addresses Plaintiff's arguments regarding standing seriatim.

8

Injury to Plaintiff's Privacy Interests

Plaintiff first argues that she has pled an injury in fact under the ECPA by plausibly alleging injury to her privacy interests, which is a traditionally recognized concrete harm. [Doc. 23 at 6-10.] More specifically, Plaintiff contends that her injuries “are based on Defendant's unauthorized disclosure of her Private Information to Facebook . . . without her consent.” [ Id. at 6.]

“The intangible harm of enduring a statutory violation, standing alone, typically won't suffice under Article III-unless there's separate harm (or a materially increased risk of another harm) associated with the violation.” O'Leary , 60 F.4th at 243. In TransUnion LLC v. Ramirez , 594 U.S. 413 (2021), the Supreme Court clarified when a statutory violation satisfies Article III standing requirements. Garey , 35 F.4th at 921. As the Fourth Circuit has explained,

plaintiffs proceeding under a statutory cause of action can establish a cognizable injury by “identif[ying] a close historical or common-law analogue for their asserted injury” for which courts have “traditionally” provided a remedy. [ TransUnion LLC , 594 U.S. at 424]. A plaintiff who does so has standing even if the precise injury would not, absent the statute, be sufficient for Article III standing purposes.

9

Id. (first alteration in original). Concrete, intangible harms with a close relationship to harms traditionally recognized as bases for lawsuits include “reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion LLC , 594 U.S. at 425. Thus, Plaintiff has alleged standing under the ECPA if she has alleged an injury bearing a close relationship to traditionally recognized harms such as reputational harms, disclosure of private information, and intrusion upon seclusion.

Plaintiff argues that the violations of the ECPA alleged here bear a close relationship to the traditionally recognized harm of disclosure of private information and, thus, she has standing under TransUnion . [Doc. 23 at 6-10.] Plaintiff has not directed the Court to any Fourth Circuit Court of Appeals case law interpreting the ECPA under the standing framework outlined in TransUnion , nor has the Court found such a case. However, the Fourth Circuit's cases and cases from other circuits following TransUnion that analyze standing under other statutes provide guidance.

Post-TransUnion Cases in the Fourth Circuit

In Garey , the Fourth Circuit analyzed the plaintiffs' standing to bring a claim under the Driver's Privacy Protection Act (“DPPA”). 35 F.4th 917. The defendants in that case were personal injury lawyers who obtained car accident reports, which included the names and address of drivers involved in car accidents, from law enforcement agencies and private data brokers. Id. at 919. The defendants used this information to mail

10

unsolicited attorney advertising materials to some of the drivers. Id. The plaintiffs in Garey were two groups of drivers who had received the advertising materials, and they sought monetary and injunctive relief, alleging that the defendants' actions violated the DPPA. Id. at 919-20. Analyzing the plaintiffs' standing under the DPPA, the court concluded that the plaintiffs had standing to pursue claims for damages because they alleged a legally cognizable privacy injury based on their receipt of the advertising materials because “the DPPA is aimed squarely at the right of the plaintiff . . . to be let alone.” Id. at 922 (internal quotation marks omitted).

In O'Leary , the Fourth Circuit analyzed the plaintiff's standing to bring a claim under South Carolina's Financial Identity Fraud and Identity Theft Protection Act (the “Identity Protection Act”). 60 F.4th 240. In that case, a nonparty credit reporting agency was subjected to a data breach and engaged the defendant to use its website to inform customers whether they were impacted by the breach. Id. at 241. Having no other way to determine whether his data had been compromised, the plaintiff went to the defendant's website, which prompted the plaintiff to enter six digits of his social security number and did not use any other security precautions. Id. The defendant then allegedly

11

shared the six digits with the nonparty credit reporting agency. Id. The plaintiff sued, alleging claims for violations of the Identity Protection Act and South Carolina's commonlaw right to privacy and for negligence. Id. The court concluded that the plaintiff had “alleged only a bare statutory violation and no Article III injury.” Id. at 242. In reaching that conclusion, the court found that the plaintiff had not alleged an injury with a close relationship to a traditional or common-law analogue because he had not pleaded anything closely related to “the unwanted intrusion into the home” to allege a harm similar to intrusion upon seclusion and had not argued that his injury was similar to the disclosure of private information. Id. at 245-46.

Additionally, in O'Leary , the Fourth Circuit stated that it was “likely for good reason” that neither party argued that disclosure of private information applied to the plaintiff because the case TransUnion relied on for that common-law analogue implicated the privacy of association guaranteed by the First Amendment and nothing in O'Leary implicated associational rights. Id. at 246. The O'Leary Court also noted that the plaintiff in that case voluntarily disclosed his partial social security number to the Defendant and not to the government. Id. This dicta in O'Leary regarding the potential applicability of disclosure of private information as an analogue suggests that the Fourth Circuit is fairly strict in applying TransUnion to harms traditionally recognized as bases for lawsuits.

Post-TransUnion Cases in Other Courts

Post- TransUnion cases from other courts of appeals analyzing standing under the Fair Debt Collection Practices Act (“FDCPA”) are also instructive. See Barclift v. Keystone Credit Servs., LLC , 93 F.4th 136 (3d Cir. 2024); Nabozny v. Optio Sols. LLC , 84 F.4th 731 (7th Cir. 2023); Shields v. Pro. Bureau of Collections of Md., Inc. , 55 F.4 823 (10th Cir. 2022);

12

Hunstein v. Preferred Collection & Mgmt. Servs., Inc. , 48 F.4th 1236 (11th Cir. 2022). In those cases, the plaintiffs filed suits against debt collectors for violations of the FDCPA based on the debt collectors' use of third-party mail vendors to send collection letters. The plaintiffs argued, as Plaintiff does in this case, that the harm they suffered was closely related to the traditional tort of public disclosure of private information. Although the courts have employed different tests to reach their conclusions, many have concluded that the plaintiffs lacked standing because the injury resulting from the communications of personal information to the third-party mail vendors did not bear a close relationship to the common-law tort of public disclosure of private information in that the alleged harm from disclosing private information to one entity is not closely related to the public disclosure of private facts. See Barclift , 93 F.4th at 146 (“When the communication of personal information only occurs between a debt collector and an intermediary tasked with contacting the consumer, the consumer has not suffered the kind of privacy harm traditionally associated with public disclosure.”); Nabozny , 84 F.4th at 736 (“The public-disclosure form of the privacy tort protects against the humiliation that accompanies the disclosure of sensitive or scandalizing private information to public scrutiny. Without a public-exposure component, [the plaintiff's] alleged injury is not analogous to the harm at the core of the public-disclosure tort.” (internal citation omitted)); Shields , 55 F.4th at 829 (“[The plaintiff's] alleged harm was that one private entity (and, presumably, some of its employees) knew of her debt. That

13

is not the same kind of harm as public disclosure of private facts, which is concerned with highly offensive information being widely known.”); Hunstein , 48 F.4th at 1250 (noting that a “benefit of the comparison [courts] are asked to make with common-law torts is that it allows [courts] to better understand whether a plaintiff has suffered a real harm” and concluding that the plaintiff was “simply no worse off because [the defendant] delegated the task of populating data into a form letter to a mail vendor [because] the public [was] not aware of his debt (at least, not because of [the defendant's] disclosure to its vendor)” and it was not clear or likely “that even a single person at the mail vendor knew about the debt or had any reason-good, bad, or otherwise-to disclose it to the public if they did”); see also Mullins v. Monarch Recovery Mgmt., Inc. , No. 5:21-CV-00120-KDB-DSC, 2022 WL 11141325, at *2 (W.D. N.C. Oct. 19, 2022) (“Publicity means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge. [The plaintiff] has failed to sufficiently allege that her private information was publicized in any actual, meaningful sense. Thus, she has not plead a claim sufficiently similar to the tort of invasion of privacy resulting from public disclosure.” (internal quotation marks and citation omitted)).

Analysis

Guided by the Supreme Court's decision in TransUnion , the Fourth Circuit's decisions applying TransUnion in the context of other statutes, and other circuits' reasoning when applying TransUnion to cases brought under the FDCPA, and considering the allegations in the Complaint with respect to the named Plaintiff, the Court concludes that Plaintiff lacks standing to bring this case under the ECPA. The Complaint

14

alleges that Plaintiff has received healthcare services from Defendant since 2012 and has used the Website to communicate Private Information to Defendant on numerous occasions; that she used the Website frequently and regularly during the past seven years “to research medical symptoms, search for specific doctors and specialists who could help with specific conditions, make appointments and, upon information and belief, check her medical records and test results and fill out medical forms”; and that her Private Information was disclosed to Facebook as a result of the Pixel and CAPI. [Doc. 1 ¶¶ 106115.] However, nothing in the Complaint alleges what happened with Plaintiff's Private Information after it was disclosed to Facebook. Although the Complaint generally alleges that, when using the Pixel and CAPI, Facebook obtains the confidential information and then sells it to third-party marketers who geotarget users' Facebook pages [ Id. ¶¶ 28], nothing in the Complaint specifically alleges that Facebook sold Plaintiff's Private Information or that Plaintiff received targeted marketing after using the Website. Additionally, nothing in the Complaint alleges that any person at Facebook accessed or viewed Plaintiff's Private Information. [ See id. ¶ 86 (alleging that the “viewing, processing, and analyzing” of the confidential information “was performed by computers and/or algorithms programmed and designed by Facebook employees”).] Therefore, based on the allegations in the Complaint, Plaintiff's alleged harm is not closely related to the

15

traditional tort of disclosure of private information. Cf. In re BPS Direct, LLC , No. 23-md-3074, 2023 WL 8458245, at *19 (E.D. Pa. Dec. 5, 2023) (concluding that a website user lacked standing to sue under the nondisclosure mandates in the Pennsylvania Uniform Firearms Act because he alleged “only one party-Facebook-received his information [and did] not allege widespread disclosure or disclosure to so many persons that the matter must be regarded as substantially certain to become one of public knowledge” and thus “[p]ublic disclosure of private facts [was] not a proper analog” (internal quotation marks and footnote omitted)). As stated, under TransUnion , the Court must analyze the harm alleged in the Complaint to determine whether Plaintiff has standing. Because Plaintiff's alleged harm is not closely related to the tort of disclosure of private information, Plaintiff lacks standing under the ECPA. Cf. J.R. v. Walgreens Boots All., Inc. , 470 F.Supp.3d 534, 552 (D.S.C. 2020) (noting that “[t]he Supreme Court of South Carolina, relying on the Restatement (Second) of Torts, has distinguished” the terms “publication” and “publicity” and that the latter “means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge” (internal quotation marks omitted)).

Plaintiff's Risk of Future Harm

Plaintiff next argues that she has alleged an injury sufficient for Article III standing because she alleges a risk of future harm. [Doc. 23 at 10-11.] More specifically, she contends that Defendant continues to disclose Plaintiff's Personal Information without proper notice and consent by “still . . . using improper tracking tools on its website.” [ Id. at 10 n.6.] Finally, Plaintiff asserts that “both Defendant and Facebook are . . . still . . . in

16

possession of, and improperly use, the disclosed information” and that she “has an interest in preventing future misuse and mishandling of her Private Information, particularly when considering the negative impact it could have on future health insurance coverage.” [ Id. at 10-11.]

A threatened injury constitutes an injury in fact when it “is certainly impending.” Clapper , 568 U.S. at 409 (internal quotation marks omitted). Sufficiently imminent injuries in fact cannot be premised on a “highly attenuated chain of possibilities.” Id. at 410.

First, addressing Plaintiff's argument that Defendant may still be using improper tracking tools, the Complaint seems to allege that Defendant no longer uses the Pixel or CAPI because of its use of the past tense when referring to Defendant's use of these tracking tools. [ See, e.g. , Doc. 1 ¶¶ 27 (“Defendant utilized the Pixel and CAPI data for marketing purposes in an effort to bolster its profits”), 67 (“In this case, Defendant employed the . . . Pixel and [CAPI] to intercept, duplicate, and re-direct Plaintiff's and Class Members' Private Information to Facebook.”), 79 (“Defendant's Pixel . . . sent nonpublic Private Information to Facebook”).] Even in her response to the motion to dismiss, Plaintiff indicates that the screenshots embedded in the Complaint “were taken from the Websites prior to the Pixel's removal ” [Doc. 23 at 8 (emphasis added)], suggesting that the Pixel is no longer on the Website. Thus, the Complaint does not allege that the threat of being injured by the Pixel and CAPI is certainly impending. Moreover, as discussed above, Plaintiff has not pled Article III standing based on the allegations that the Pixel and CAPI being used on the Website resulted in her Private Information being disclosed to Facebook. Therefore, even if the Complaint were read to allege that the Pixel and CAPI

17

are still being used on the Website, Plaintiff has not shown a risk of a future injury sufficient to confer standing.

Further, Plaintiff's assertion that Defendant and Facebook are still in possession of the disclosed information and that this possession could negatively impact her future health insurance coverage is premised on a “highly attenuated chain of possibilities” that the Supreme Court has held “does not satisfy the requirement that threatened injury must be certainly impending.” Clapper , 568 U.S. at 1148. Given the Complaint's lack of allegations regarding what happened with Plaintiff's Private Information after it was allegedly disclosed to Facebook, even crediting Plaintiff's assertion that Facebook is still in possession of the disclosed information, Facebook would then have to share Plaintiff's Private Information with a health insurance company, and not just any health insurance company, but one that either provides coverage or contemplates providing coverage to Plaintiff. See O'Leary , 60 F.4th at 245 (holding that, in the data breach context, a plaintiff who cannot connect the alleged statutory violation to an increased risk of identity theft without a “Rube Goldberg-type chain reaction” lacks standing); Beck , 848 F.3d at 274 (holding that without evidence of misuse by data thieves, an enhanced risk of identity theft as a result of a data breach is too speculative to constitute an injury in fact). Thus, Plaintiff has not pled standing based on the risk of future harm.

Invasion of Plaintiff's Privacy

Plaintiff next argues that her allegations of invasion of privacy are sufficient for Article III standing. [Doc. 23 at 11.]

Invasion of privacy claims in South Carolina may be broken down into three separate causes of action: wrongful appropriation of personality, wrongful publicizing of

18

private affairs, and wrongful intrusion into private affairs. Doe 2 v. Associated Press , 331 F.3d 417, 421 (4th Cir. 2003). Plaintiff does not specify which cause of action her invasion of privacy claim is based on, but from the allegations in the Complaint, the Court construes the Complaint as asserting both the wrongful publicizing of private affairs and the wrongful intrusion into private affairs. [Doc. 1 ¶¶ 184-201.]

Plaintiff has not pled standing based on the wrongful publicizing of private affairs for the same reasons discussed above--namely, Plaintiff has not alleged that her private information was publicized. Nor has Plaintiff pled standing based on the wrongful intrusion into private affairs. The Court of Appeals of South Carolina has noted that “[i]n an action for wrongful intrusion into private affairs, the damage consists of the unwanted exposure resulting from the intrusion.” Snakenberg v. Hartford Cas. Ins. Co. , 383 S.E.2d 2, 6 (S.C. Ct. App. 1989). And the Supreme Court of South Carolina has held that where “a plaintiff bases an action for invasion of privacy on intrusion, bringing forth no evidence of public disclosure, it is incumbent upon him to show a blatant and shocking disregard of his rights, and serious mental or physical injury or humiliation to himself resulting therefrom.” O'Shea v. Lesser , 416 S.E.2d 629, 633 (S.C. 1992) (internal quotation marks omitted). Here, Plaintiff has not alleged that she has suffered any serious mental or physical injury or humiliation resulting from the alleged intrusion. Accordingly, she has not pled standing based on the wrongful intrusion into private affairs.

19

Plaintiff's Being Deprived of the Benefit of Her Bargain

Next, Plaintiff argues that she has standing because she was deprived of the benefit of her bargain. [Doc. 23 at 11-13.] More specifically, Plaintiff contends that she suffered an economic loss because she “did not get the full value of the medical services for which [she] paid, which included Defendant's duty to maintain confidentiality.” [ Id. at 12 (internal quotation marks omitted).]

“[T]he Fourth Circuit has never held that an overpayment benefit-of-the-bargain theory in a data breach context is sufficient to confer standing.” Podroykin v. Am. Armed Forces Mut. Aid Assoc. , 634 F.Supp.3d 265, 272 (E.D. Va. 2022). Moreover, “even courts willing to entertain this theory of standing consistently reject this theory in data breach cases where plaintiffs have not alleged that the value of the goods or services they purchased was diminished as a result of the data breach.” Id. (cleaned up). For example, in Podroykin , the complaint alleged that “had [the plaintiff] known that [the defendant] was vulnerable to a cyber-attack, he would not have purchased or would have paid less for the insurance policy” he had purchased from the defendant. Id. (internal quotation marks omitted). However, the complaint did not allege “that the actual value of the insurance policy ha[d] decreased.” Id. The failure to allege that the actual value of the insurance policy had decreased led the court to conclude that the complaint failed to

20

allege facts sufficient to confer standing based on the benefit-of-the-bargain injury. Id. ; see also Chambliss v. Carefirst, Inc., 189 F.Supp.3d 564, 572 (D. Md. 2016) (concluding that the plaintiffs did not have standing based on a benefit-of-the-bargain injury where they “ma[d]e no allegations that the data breach diminished the value of the health insurance they purchased from” the defendant and offered “no factual allegations indicating that the prices they paid for health insurance included a sum to be used for data security, and that both parties understood that the sum would be used for that purpose”).

Here, like the complaints in Podroykin and Chambliss , which did not allege that the value of the items the plaintiffs purchased from the defendants was diminished, the Complaint does not allege that the value of any medical services Plaintiff purchased from Defendant was diminished because of the disclosure of Plaintiff's Private Information. Instead, the Complaint alleges only that Plaintiff would not have used the Website, would not have provided her Private Information to Defendant, and would not have paid for Defendant's services or would have paid less for them had she known that Defendant would have disclosed her Private Information to third parties. [Doc. 1 ¶¶ 150, 272.d, 281.g, 288.g.] Such allegations are insufficient to support standing based on a benefit-of-the-bargain injury theory. See also Blood v. Labette Cnty. Med. Ctr. , No. 5:22-cv-04036-HLT-KGG, 2022 WL 11745549, at *6

21

(D. Kan. Oct. 20, 2022) (citing cases and rejecting the argument that the plaintiffs established standing by alleging that they overpaid for medical services where a portion of their payment for those services was allegedly for data security); Austin-Spearman v. AARP & AARP Servs., Inc. , 119 F.Supp.3d 1, 14 (D.D.C. 2015) (“This Court finds that, having not established that she actually lost any of the value of her membership, [the plaintiff] has not plausibly claimed that she overpaid for the AARP membership agreement such that she was injured economically and now has standing to sue.”).

Diminution in Value of Plaintiff's Private Information

Finally, Plaintiff argues that she suffered a concrete economic injury because the value of her Private Information diminished from being disclosed. [Doc. 23 at 13.]

“The Fourth Circuit has not [explicitly] decided whether the loss of property value in [Private Information] constitutes a cognizable injury in data breach cases.” Darnell v. Wyndham Cap. Mortg., Inc. , No. 3:20-CV-00690-FDW-DSC, 2021 WL 1124792, at *5 (W.D. N.C. Mar. 24, 2021) (internal quotation marks omitted) (first alteration in original). As the Eastern District of Virginia has recognized, “courts that are willing to consider diminution in the value of PII as a basis for standing do so when there are allegations of

22

some concrete injury, such as lower credit scores or fraudulent accounts and tax returns filed in plaintiff's name.” Podroykin , 634 F.Supp.3d at 272 (cleaned up).

Here, although the Complaint sufficiently alleges that Plaintiff's Private Information had financial value [Doc. 1 ¶¶ 163-66], it fails to allege any facts explaining how Plaintiff lost value because of the disclosure of her Private Information, see Podroykin , 634 F.Supp.3d at 272 (concluding that the plaintiff could not argue that the value of his PII had been diminished because he could not “even allege that his PII had been misused”); see also Blood , 2022 WL 11745549, at *6 (“Even if Plaintiffs' [Private Information] ha[s] monetary value, as Plaintiffs allege, they do not allege facts explaining how they lost value because of the breach. They do not allege (nor likely would they) that they tried to sell their information and couldn't or were offered less that its value.”); Chambliss , 189 F.Supp.3d at 572 (“This Court need not decide whether such personal information has a monetary value, as Plaintiffs have not alleged that they have attempted to sell their personal information or that, if they have, the data breach forced them to accept a decreased price for that information.”). Accordingly, Plaintiff has not pled standing based on the diminution in value of her Private Information.

Conclusion Regarding Standing

Based on the above, the Court concludes that Plaintiff lacks standing to bring her claims in this case. Although some cases reach a different conclusion regarding standing in data compromise cases, most of those cases involve allegations of not only the disclosure of Private Information, but actual misuse of that information. See Williams , 2024 WL 898051, at *4; In re Marriott Int'l , 440 F.Supp.3d at 457; see also Smith v. Loyola Univ. Med. Ctr. , No. 23 CV 15828, 2024 WL 3338941, at *2, 4 (N.D. Ill. July 9, 2024)

23

(recognizing that the named plaintiffs received targeted medical advertising related to their medical conditions and prescriptions and concluding that the plaintiffs had standing to pursue claims for damages and injunctive relief). Moreover, most of the case law Plaintiff cites to support her argument that she has pled an injury in fact sufficient for Article III standing is from outside the Fourth Circuit [ see Doc. 23 at 6-13], but this Court is bound by Fourth Circuit precedent. As the Fourth Circuit has explained regarding its data-breach precedents,

In Beck v. McDonald , we held that plaintiffs whose personal information was compromised in a data breach hadn't shown an Article III injury based on an alleged “increased risk of future identity theft and the cost of measures to protect against it.” 848 F.3d 262, 267 (4th Cir. 2017). The plaintiffs' alleged increased risk was only speculative, and even though a laptop and reports with their personal information had been stolen, “the mere theft of these items, without more, cannot confer Article III standing.” Id. at 275.

In contrast, the plaintiffs in Hutton v. National Board of Examiners in Optometry, Inc. , were, in fact, victims of identity theft traceable to the defendant's data breach. 892 F.3d 613, 621-22 (4th Cir. 2018). Unlike the Beck plaintiffs, who relied on “a mere compromise of personal information,” the Hutton plaintiffs suffered identity theft and credit-card fraud such that there was “no need to speculate on whether substantial harm will befall” them-it already had. Id. at 621-22. So those plaintiffs had standing.

O'Leary , 60 F.4th at 244. Given the Fourth Circuit's guidance that “the mere theft of [personal information], without more, cannot confer Article III standing,” Beck , 848 F.3d at 275, and “a mere compromise of personal information, without more, fails to satisfy the injury-in-fact element in the absence of an identity theft,” Hutton , 892 F.3d at 621, the Court concludes that Plaintiff lacks Article III standing because her claims are limited to Defendant's alleged disclosure of her Private Information, see O'Leary , 60 F.4th at 244-46;

24

cf. Bruce v. T-Mobile USA, Inc. , No. 2:21-cv-895-BHH, 2023 WL 2011460, at *2 (D.S.C. Feb. 14, 2023) (“[B]ecause Plaintiff has alleged nothing more than a mere compromise of personal information, without more, the Court agrees with the Magistrate Judge that he lacks Article III standing at this time.”), appeal dismissed , No. 23-1785, 2023 WL 9421694 (4th Cir. Oct. 30, 2023); Betz v. St. Joseph's/Candler Health Sys., Inc. , 630 F.Supp.3d 734, 751-52 (D.S.C. 2022) (“[A]lthough Plaintiff alleges that her personal information was targeted and stolen for nefarious purposes, . . . Plaintiff does not allege any actual misuse of her information, and the Court ultimately finds that Plaintiff's allegations fail to show that a risk of future harm is ‘certainly impending' or concrete as opposed to merely speculative.”). Therefore, the Court grants Defendant's motion to dismiss for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure.

Request to Amend

At the April 30 hearing, Plaintiff requested leave to amend if the Court concludes that Plaintiff lacks standing. Although a “court should freely give leave [to amend] when

25

justice so requires,” Fed.R.Civ.P. 15(a)(2), leave to amend should be denied if the opposing party would be prejudiced by the amendment, the moving party has acted in bad faith, or the amendment would be futile, Laber v. Harvey , 438 F.3d 404, 426 (4th Cir. 2006) (en banc). Here, the Court declines to grant Plaintiff leave to amend because it appears that amendment would be futile as Plaintiff has provided the Court with no reason to believe that she would be able to sufficiently plead Article III standing in any amended complaint. Indeed, at the hearing, as in her briefing, Plaintiff continued to maintain that the disclosure alone of her Private Information is sufficient for Article III standing. However, as discussed above, the Court disagrees with Plaintiff's arguments that she has established standing based on the allegations of disclosure alone. At no point has Plaintiff asserted to the Court that she could plead additional facts to show injury beyond the disclosure itself, nor has she moved to amend the Complaint or submitted a proposed amended complaint. See ACA Fin. Guar. Corp. v. City of Buena Vista , 917 F.3d 206, 218 (4th Cir. 2019) (concluding that, even if requests to amend were considered motions to amend, because the plaintiffs “never indicated what amendments they were seeking,” “never identified any facts they sought to include in an amendment,” and “never identified any cause of action they sought to add in an amendment,” “there was no way for a district court to evaluate whether the proposed amendments were futile or not”).

CONCLUSION

Wherefore, based upon the foregoing, Defendant's motion to dismiss [Doc. 15] is GRANTED, and this case is DISMISSED without prejudice.

26

IT IS SO ORDERED.