Free Motion to Dismiss - District Court of California - California

Case 3:08-cv-01173-H-CAB

Document 18

Filed 08/14/2008

Page 1 of 2

1 2 3 4 5 6 7 8 9 10 11 12

KATHLENE W. LOWE (SBN 145404) KENT J. SCHMIDT (SBN 195969) JOHN P. CLEVELAND (SBN 239749) DORSEY & WHITNEY LLP 38 Technology Drive, Suite 100 Irvine, CA 92618-5310 Telephone: (949) 932-3600 Facsimile: (949) 932-3601 Attorneys for Defendant NEW ALBERTSON'S, INC.

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF CALIFORNIA

RAYMOND W. LONDON, on behalf of Himself and All Others Similarly Situated, Plaintiff,

CASE NO.:

08-1173 HC AB

Assigned to: Hon. Marilyn Huff vs.

13 14 15 16 Defendants. 17 18 19 20 21 22 23 24 25 26 27 28 1
NOTICE OF MOTION AND MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

NEW ALBERTSON'S, INC.; CERBERUS CAPITAL MANAGEMENT (CALIFORNIA), LLC, and SAVE MART SUPERMARKETS,

NOTICE OF MOTION AND MOTION TO DISMISS FIRST AMENDED COMPLAINT SPECIAL BRIEFING SCHEDULE ORDERED [CivLR 7.1 E(8)] Hearing: Date: Time: Courtroom: September 29, 2008 10:30 a.m. 13, Fifth Floor

Complaint filed: May 29, 2008 First Amended Complaint filed: July 28, 2008 /// /// ///

Case 3:08-cv-01173-H-CAB

Document 18

Filed 08/14/2008

Page 2 of 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

TO ALL PARTIES AND THEIR ATTORNEYS OF RECORD: PLEASE TAKE NOTICE THAT on September 29, 2008 at 10:30 a.m., or as soon thereafter as this matter may be heard, in Courtroom 13, Fifth Floor, of the United States District Court for the Southern District of California located at 940 Front Street, San Diego, CA 92101-8900, Defendant New Albertsons, Inc. shall, and hereby does, move the Court for an Order dismissing all purported causes of action alleged by Plaintiff in the First Amended Complaint pursuant to Rules 9(b), 12(b)(1), and 12(b)(6) of the Federal Rules of Civil Procedure. This motion is made on the grounds that each claim in the First Amended Complaint fails to state a claim upon which relief can be granted and fails to set forth the circumstances constituting the alleged wrongdoing with the required particularity. In addition, because Plaintiff lacks standing to bring this action, the Court lacks subject matter jurisdiction. This motion is based upon this Notice of Motion and Motion, the accompanying memorandum of points and authorities, the declaration of Kathlene W. Lowe and any evidence and argument presented at the hearing of this motion. DORSEY & WHITNEY LLP

16 Dated: August 14, 2008 17 18 19 20 21 22 23 24 25 26 27 28 2
NOTICE OF MOTION AND MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

By: s/ Kent J. Schmidt KATHLENE W. LOWE KENT J. SCHMIDT JOHN P. CLEVELAND Attorneys for Defendant NEW ALBERTSON'S, INC.

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 1 of 39

1 2 3 4 5 6 7 8 9 10 11 12

KATHLENE W. LOWE (SBN 145404) KENT J. SCHMIDT (SBN 195969) JOHN P. CLEVELAND (SBN 239749) DORSEY & WHITNEY LLP 38 Technology Drive, Suite 100 Irvine, CA 92618-5310 Telephone: (949) 932-3600 Facsimile: (949) 932-3601 Attorneys for Defendant NEW ALBERTSON'S, INC.

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF CALIFORNIA

RAYMOND W. LONDON, on behalf of Himself and All Others Similarly Situated, Plaintiff,

CASE NO.:

08-1173 HC AB

Assigned to: Hon. Marilyn Huff vs.

13 14 15 16 Defendants. 17 18 19 20 21 22 23 24 25 26 27 28
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

NEW ALBERTSON'S, INC.; CERBERUS CAPITAL MANAGEMENT (CALIFORNIA), LLC, and SAVE MART SUPERMARKETS,

MEMORANDUM OF POINTS AND AUTHORITIES OF DEFENDANT NEW ALBERTSON'S, INC. IN SUPPORT OF ITS MOTION TO DISMISS FIRST AMENDED COMPLAINT SPECIAL BRIEFING SCHEDULE ORDERED [CivLR 7.1 E(8)] Hearing: Date: Time: Courtroom: September 29, 2008 10:30 a.m. 13, Fifth Floor

Complaint filed: May 29, 2008 First Amended Complaint filed: July 28, 2008 /// /// ///

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 2 of 39

1 2 3 4 5 B. 6 1. 7 2. 8 (a) 9 10 11 C. 12 13 14 15 1. 16 2. 17 3. 18 (a) 19 (b) 20 4. 21 F. 22 23 24 25 26 27 28 D. E. (b)

TABLE OF CONTENTS INTRODUCTION ..................................................................................................................................1 FACTS ....................................................................................................................................................2 A. The Court Should Disregard Plaintiff's Conclusory Allegations That Defendants "Inadequately" De-Identified Prescription Data. ........................................................................3 The First Amended Complaint Fails to State a Claim for Violation of the CMIA.....................5 Background of the CMIA and its Legislative Intent.......................................................5 The CMIA's Disclosure Exceptions Permit the Conduct At Issue .................................6 Section 56.10(c)(16) Expressly Permits Using a Third Party to Encode, Encrypt or "Anonymize" Data to Remove Identifying Information...................7 Section 56.10(c)(14) Expressly Permits the Conduct Alleged in the First Amended Complaint Because It Is Authorized by the Privacy Rule ..................8

Even if the CMIA Were Read to Prohibit the Conduct At Issue, the First Amendment Prevents Its Application to Anonymized Data..........................................................................10 All Remaining Causes of Action Are Preempted by Federal Law ...........................................12 The First Amended Complaint Fails to State a Cause of Action for Breach of Contract or the Implied Covenant of Good Faith and Fair Dealing ........................................................13 Elements of a Breach of Contract .................................................................................13 Plaintiff Has No Cognizable Damages .........................................................................13 Plaintiff Does Not Allege Breach .................................................................................16 Albertsons' Privacy Notice Does Not Apply to De-Identified Data.................16 No Other Alleged Promises Concern De-Identified Data.................................17

Breach of Implied Covenant of Good Faith and Fair Dealing ......................................18

The First Amended Complaint Fails to State a Cause of Action for "Suppression of Fact" ..........................................................................................................................................18 1. Plaintiff Does Not State A Claim for Fraud..................................................................18 (a) (b) (c) (d) (e) Plaintiff Does Not and Cannot Allege the Requisite Duty ...............................19 Plaintiff Cannot Establish Cognizable Damages ..............................................20 Plaintiff Cannot Establish Causation ................................................................20 Plaintiff Fails to Allege Any Material Undisclosed Information......................20 Plaintiff Fails to Plead Fraud With Specificity .................................................20
i MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 3 of 39

G. 1 2 3 4 5 6 7 8 H. I. J.

There is No Reasonable Expectation of Privacy Concerning De-Identified Information and the Breach of Privacy Claim Fails to State a Cause of Action...........................................21 1. 2. 3. Plaintiff Has No Legally Protected Privacy Interest in This Data ................................21 Plaintiff Has No Reasonable Expectation of Privacy in the Circumstances.................22 There Is No Serious Invasion of Privacy At Issue Here ...............................................22

The First Amended Complaint Fails to State a Cause of Action for Unjust Enrichment .........23 Plaintiff Does Not State A "Trespass to Personalty" Claim .....................................................24 The First Amended Complaint Fails to State a Cause of Action for a Violation of California's Unfair Competition Law .......................................................................................24 1. Plaintiff Cannot Allege Loss of Money or Property .....................................................24 No Allegations of Unlawful Conduct ...........................................................................25 No Allegations of Unfair Conduct ................................................................................25 No Allegations of Fraudulent Conduct .........................................................................26

9 2. 10 3. 11 4. 12 K. 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
ii MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

The First Amended Complaint Fails to State a Cause of Action for a Violation of California's Consumer Legal Remedies Act.............................................................................26 1. 2. Plaintiff Failed to Provide Statutory Notice for a CLRA Claim...................................27 Plaintiff Fails to State a Viable CLRA Claim...............................................................28

L.

Plaintiff Lacks Standing to Sue.................................................................................................29

CONCLUSION .....................................................................................................................................30

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 4 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 CALIFORNIA CASES

TABLE OF AUTHORITIES Page(s) Aron v. U-Haul Co. of California, 143 Cal. App. 4th 796 (2006) ................................................................................................. 28 Bank of the West v. Superior Court, 2 Cal. 4th 1254 (1992) ............................................................................................................ 26 Berry v. Am. Express Publ'g, Inc., 147 Cal. App. 4th 224 (2007) ................................................................................................. 28 Building Permit Consultants v. Mazur, 122 Cal. App. 4th 1400 (2004)................................................................................................. 20 Camp v. Jeffer, Mangels, Butler & Marmaro, 35 Cal. App. 4th 620 (1995) ................................................................................................... 18 Careau & Co. v. Security Pacific Business Credit, Inc., 222 Cal. App. 3d 1371 (1990)........................................................................................... 13, 18 Cel-Tech Communications, Inc. v. Los Angeles Cellular Telephone Co., 20 Cal. 4th 163 (1999) ...................................................................................................... 25, 26 Church Divinity School of Pacific v. Alameda County, 152 Cal. App. 2d 496 (1957)..................................................................................................... 8 Colleen M. v. Fertility and Surgical Associates of Thousand Oaks, 132 Cal. App. 4th 1466 (2005) ................................................................................................. 6 Consumer Advocacy Group, Inc. v. Kintetsu Enterprises of America, 150 Cal. App. 4th 953 (2007)................................................................................................... 25 Dinosaur Development, Inc. v. White, 216 Cal. App. 3d 1310 (1989)................................................................................................. 23 Dwyer v. American Express Co., 652 N.E.2d 1351 (Ill. App. 1995) ............................................................................... 14, 15, 22 Fladeboe v. American Isuzu Motors, 150 Cal. App. 4th 42 (2007)..................................................................................................... 20 Gould v. Maryland Sound Industries, Inc., 31 Cal. App. 4th 1137 (1995) ................................................................................................. 18 Guz v. Bechtel Nat'l, Inc., 24 Cal. 4th 317 (2000) ............................................................................................................ 18

iii MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 5 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Hadley v. Baxendale, 9 Ex. 341, 156 Eng. Rep. R. 145............................................................................................. 15 Hill v. National Collegiate Athletic Ass'n 7 Cal. 4th 1 (1994) ................................................................................................ 21, 22, 23, 25 Khoury v. Maly's of California, Inc., 14 Cal. App. 4th 612 (1993) ................................................................................................... 25 Marketing West, Inc. v. Sanyo Fisher (USA) Corp., 6 Cal. App. 4th 603 (1992) ..................................................................................................... 19 Moore v. Regents of the University of California, 51 Cal. 3d 120 (1990) ............................................................................................................. 14 Outboard Marine Corp. v. Superior Court, 52 Cal. App. 3d 30 (1975)....................................................................................................... 27 Pettus v. Cole, 49 Cal. App. 4th 402 (1996) ..................................................................................................... 6 Pioneer Electronics (USA), Inc. v. Superior Court, 40 Cal. 4th 360 (2007) ...................................................................................................... 21, 23 Shaddox v. Bertani, 110 Cal. App. 4th 1406 (2003) ............................................................................................. 6, 9 Shibley v. Time, Inc., 341 N.E.2d 337 (Ohio App. 1975).................................................................................... 14, 22 Shvarts v. Budget Group, Inc., 81 Cal. App. 4th 1153 (2000) ................................................................................................. 26 Tarmann v. State Farm Mut. Auto. Ins. Co., 2 Cal. App. 4th 153 (1991) ............................................................................................... 20, 21 Thrifty-Tel, Inc. v Bezenek, 46 Cal. App. 4th 1559 (1996) ................................................................................................. 24 U.S. News & World Report, Inc. v. Avrahami, No. 95-1318, 1996 Va. Cir. LEXIS 518 (Va. Cir. June 13, 1996).......................................... 14 Yamaha Corp. of America v. State Bd. of Equalization, 19 Cal. 4th 1 (1998) .................................................................................................................. 9

FEDERAL CASES Accord: IMS Health Inc. v. Ayotte, 490 F. Supp. 2d 163 (D.N.H. 2007) ................................................................................. passim
iv MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 6 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Accuimage Diagnostics Corp. v. Terarecon, Inc., 260 F. Supp. 2d 941 (N.D. Cal. 2003) .................................................................................... 25 Bell Atlantic Corp. v. Twombly, __ U.S. __, 127 S.Ct. 1955 (2007) ............................................................................................ 4 Cattie v. Wal-Mart Stores, Inc., 504 F. Supp. 2d 939 (S.D. Cal. 2007) ..................................................................................... 27 Central Hudson Gas & Elec. Corp. v. Public Service Comm'n of New York, 447 U.S. 557 (1980) ................................................................................................................ 11 Cipollone v. Liggett Group, 505 U.S. 504 (1992) ................................................................................................................ 13 Craig v. Boren, 429 U.S. 190 (1976) ................................................................................................................ 11 Estate of Migliaccio v. Midland Nat'l. Life Ins. Co., 436 F. Supp. 2d 1095 (C.D. Cal. 2006) .................................................................................. 29 Haskell v. Time, Inc., 857 F. Supp. 1392 (E.D. Cal. 1994)........................................................................................ 26 Hsu v. OZ Optics, Ltd., 211 F.R.D. 615 (N.D. Cal. 2002) ............................................................................................ 13 IMS Health Corp. v. Rowe, 532 F. Supp. 2d 153 (D. Maine 2007); as modified, 532 F.Supp.2d 183 ........................ passim In Re Jetblue Airways Corp. Privacy Litigation, 379 F. Supp. 2d 299 (E.D.N.Y. 2005) .................................................................. 14, 15, 16, 20 In re Late Fee and Over-Limit Fee Litigation, 528 F. Supp. 2d 953 (N.D. Cal. 2007) .................................................................................... 28 In re Stac Electronics Securities Litigation, 89 F.3d 1399 (9th Cir. 1996)................................................................................................... 21 In re Trans Union Corp. Privacy Litigation, 326 F. Supp. 2d 893 (N.D. Ill. 2004) ................................................................................ 14, 15 Laster v. T-Mobile USA, Inc., 407 F. Supp. 2d 1181 (S.D. Cal. 2005) ................................................................................... 27 Papasan v. Allain, 478 U.S. 265 (1986) .................................................................................................................. 4 Thompson v. Home Depot, Inc., 2007 U.S. Dist. LEXIS 68918 (S.D. Cal. September 18, 2007) ....................................... 14, 25
v MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 7 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

Thompson v. W. States Med. Ctr., 535 U.S. 357 (2002) ................................................................................................................ 11 Virginia State Board of Pharmacy v. Virginia Citizens Consumer Council, Inc., 425 U.S. 748 (1976) ................................................................................................................ 11 Von Grabe v. Sprint, 312 F. Supp. 2d 1285 (S.D. Cal. 2003) ............................................................................. 27, 28 Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136 (9th Cir. 2003).................................................................................................... 4 Watson Laboratories, Inc. v. Rhône-Poulenc Rorer, Inc., 178 F. Supp. 2d 1099 (C.D. Cal. 2001) ............................................................................ 25, 26

STATUTES, RULES AND REGULATIONS Cal. Bus. & Prof. Code § 17200 ................................................................................... 1, 24, 25, 26 Cal. Civ. Code § 56.05(g) ............................................................................................................... 5 Cal. Civ. Code § 56.10(a) ........................................................................................................... 5, 6 Cal. Civ. Code § 56.10(b) ............................................................................................................... 7 Cal. Civ. Code § 56.10(c) ............................................................................................................... 7 Cal. Civ. Code § 56.10(d) ........................................................................................................... 5, 6 Cal. Civ. Code § 56.10(c)(14)................................................................................................. 7, 8, 9 Cal. Civ. Code § 56.10(c)(16)................................................................................................. 5, 7, 8

19 20 21 22 23 24 25 26 27 28
vi MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

Cal. Civ. Code § 1750 ..................................................................................................................... 1 Cal. Civ. Code § 1770(a)(4).......................................................................................................... 28 Cal. Civ. Code § 1770(a)(5).......................................................................................................... 28 Cal. Civ. Code § 1770(a)(9).................................................................................................... 28, 29 Cal. Civ. Code § 1770(a)(14).................................................................................................. 28, 29 Cal. Civ. Code § 1782(a) .............................................................................................................. 27 Cal. Civ. Code § 1782(d) .............................................................................................................. 27 Cal. Civ. Code § 3300 ................................................................................................................... 15

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 8 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13

45 C.F.R. pts. 160 ........................................................................................................................... 9 45 C.F.R. pts. 164 ........................................................................................................................... 9 45 C.F.R. § 160.203 ...................................................................................................................... 12 45 C.F.R. § 164.501 ........................................................................................................................ 9 45 C.F.R. § 164.502(a).............................................................................................................. 9, 12 45 C.F.R. § 164.502(d) ............................................................................................................. 9, 12 45 C.F.R. § 164.514(a).................................................................................................................. 12 45 C.F.R. § 164.514(b) ................................................................................................................. 12 65 Fed. Reg. 59946 ....................................................................................................................... 12 65 Fed. Reg. 82462-01 .................................................................................................................. 12 65 Fed. Reg. 82543 ....................................................................................................................... 13 65 Fed Reg. 82543 ........................................................................................................................ 12 67 Fed. Reg. 53182 ......................................................................................................................... 9

14 Fed. R. Civ. P. 11 ............................................................................................................................ 4 15 16 17 18 19 20 21 22 23 24 25 26 27 28
vii MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

Fed. R. Civ. P. 12(b)(6)............................................................................................................. 4, 27 N.H. Rev. Stat. Ann. § 318-B:12(IV) ........................................................................................... 10 N.H. Rev. Stat. Ann. § 318:47-f.................................................................................................... 10 N.H. Rev. Stat. Ann. § 318:47-g ................................................................................................... 10

CONSTITUTIONAL PROVISIONS California Constitution, Article I, § 1 ........................................................................................... 25 U. S. Constitution, First Amendment..................................................................................... passim

OTHER AUTHORITIES 15 Moore's Federal Practice (3d ed. 2008), § 101.51[3][a].................................................... 29, 30 1 Witkin, Summary of California Law (10th ed.) § 869 .......................................................... 15, 18

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 9 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1 Witkin, Summary of California Law (10th ed.), Contracts § 798 ............................................... 18 1 Witkin, Summary of California Law (10th ed.), Contracts § 871 ............................................... 15 1 Witkin, Summary of California Law (10th ed.), Contracts, § 97 ................................................ 23 Federal Practice and Procedure § 1216 at 235-36........................................................................... 4

viii MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT

CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 10 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

INTRODUCTION In this putative class action, Plaintiff Raymond W. London ("Plaintiff") complains that, after he filled prescriptions at a Sav-On drugstore owned by Defendant New Albertson's, Inc., ("Albertsons") Albertsons sold "de-identified information" about his prescriptions to "data mining companies" ("DMCs"). "De-identified information" has been stripped of all data which could identify the individual to whom the prescription was issued (name, address, telephone number, email address, social security number). That de-identified data becomes "prescriber-identifiable" after DMCs combine it with information about doctors which DMCs obtain from the American Medical Association and other sources. The resulting aggregated data (from pharmacies and from medical associations) reveals specific details about the prescribing habits of individual physicians. DMCs sell this de-identified aggregated data to pharmaceutical companies, which use that information in targeted marketing campaigns to persuade doctors to prescribe patented medications.1 Plaintiff alleges that Defendants' sales of de-identified data violate three California statutes: its Confidentiality of Medical Information Act ("CMIA"), Cal. Civil Code §§ 56.10 et seq., its Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200 et seq., and, in the recently amended complaint, the Consumer Legal Remedies Act ("CLRA"), Cal. Civ. Code §§ 1750 et seq. None of these statutes prohibits these data sales. He asserts six common law causes of action arising from the same conduct: breach of contract and of the implied covenant of good faith and fair dealing, fraud (suppression of fact), breach of privacy, unjust enrichment, and trespass to personalty. Except for his CMIA claim, all of Plaintiff's causes of action are preempted by federal law. In addition, his statutory and privacy claims cannot survive First Amendment scrutiny. Central to all of Plaintiff's claims are two themes: that these data sales invade his privacy rights, and that he "owns" the de-identified data about his prescriptions. Because neither premise has any basis, his entire First Amended Complaint must fail. In addition, Plaintiff lacks standing to

This data is also "of considerable interest to government agencies, academic institutions, health insurance companies, health maintenance organizations, and other entities" to whom DMCs also sell this data. IMS Health Corp. v. Rowe, 532 F. Supp. 2d 153, 158 (D. Maine 2007); as modified, 532 F.Supp.2d 183. Accord: IMS Health Inc. v. Ayotte, 490 F. Supp. 2d 163, 166 (D.N.H. 2007). The Complaint speaks only about DMCs' sales to pharmaceutical companies, though, and ignores all these other salutary uses of the same data.

1

1
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 11 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

complain of Defendants' sales of data about his doctors' prescribing practices. Each of his claims also fails for other, independently sufficient reasons. Plaintiff has therefore failed to state a claim upon which relief may be granted and this Court should dismiss this action with prejudice because it cannot be cured through amendment. FACTS Plaintiff's First Amended Complaint contains extensive allegations that have no bearing on whether Plaintiff states a claim against these defendants, and which are instead designed to provoke resentment at pharmaceutical companies. While pharmaceutical companies are a popular target (perhaps second only to oil companies), none is named as a Defendant in this case.2 The gravamen of these allegations is that the pharmaceutical industry combines de-identified prescription information with physician-specific data to create "prescriber-identifiable data,"3 which pharmaceutical companies use to market prescription drugs to doctors. Plaintiff's original complaint contained no allegation that Defendants sell individually identifiable information about him or other pharmacy customers to any DMC. After Albertsons moved to dismiss that complaint, Plaintiff amended his pleading to allege that Albertsons "inadequately" de-identifies his data (FAC ¶¶ 2, 12, 15). This conclusory and speculative allegation, as discussed below, cannot breathe life into this case. The conduct at issue is not the sale of individually identifiable information about patients; it is instead the sale of anonymized patient data which reveals the prescribing practices of individual doctors ­ what drugs they prescribe, in what dosages, what generic substitutes they prescribe, and the like. The allegations which describe Defendants' role in this process are sparse. A patient provides his drug prescription to a pharmacy, along with his name, address, and telephone number (FAC ¶¶ 8, 9). The DMCs which buy Albertsons' prescription data (id. ¶ 11) acquire that data by installing software on Albertsons' mainframe computer which captures and collates data about all prescriptions (id. ¶ 15). Defendants and/or DMCs remove information which could identify individual patients

2 Defendant Albertsons owns supermarkets and pharmacies in many states. Defendant Cerberus is merely the partial owner of a company which purchased some Albertsons stores in 2006 and is therefore not even a proper defendant. Plaintiff also recently filed a Doe amendment which brought in SaveMart as a new defendant. SaveMart purchased some Northern California supermarkets from a third party in 2007. 3 See, e.g., FAC ¶¶ 16, 17, 19, and 21 for references to "prescriber-identifiable data."

2
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 12 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

before transferring any data to their pharmaceutical company customers (id. ¶ 12).4 A number is assigned to each de-identified patient which permits all prescription information for one patient to be correlated, but "purportedly" does not allow the patient's identity to be determined (id. ¶ 15). Before DMCs sell this data, they combine it with other information about the doctor who issued each prescription (id.). That data, obtained from the AMA and other third parties, identifies the prescriber's correct name, address, specialty, and other professional information (id. ¶ 16). ARGUMENT A. The Court Should Disregard Plaintiff's Conclusory Allegations That Defendants "Inadequately" De-Identified Prescription Data. On June 11, 2008, Albertsons moved to dismiss the original Complaint. That motion's central theme was that Plaintiff has no claim arising from the sale of data about the prescribing habits of third parties ­ his physicians ­ which is derived from anonymous information about patients. In response to that motion, Plaintiff filed a First Amended Complaint which speculates that Defendants may instead be disclosing information which, after some investigation, could identify him. While the original complaint conceded that individually identifying information is removed before transmittal to DMCs, the new pleading claims that patient information is "inadequately de-identified" because pharmaceutical companies might combine that information with other "publicly or privately available" data to identify individual patients (compare Compl. ¶ 9, 12 with FAC ¶¶ 12, 15). Nowhere in the First Amended Complaint does Plaintiff explain what data remains in place which makes its de-identification "inadequate." Furthermore, if pharmaceutical companies want this data to target doctors, it is nonsensical to suggest that they would waste time trying to identify individual patients. Plaintiff does not claim that anyone actually does reverse engineer the data so as to reveal patient identity; instead, we are left only with the alleged possibility that someone, somewhere might be able to do so. Since Plaintiff does not allege that anyone has actually seen or will see information which

4 This allegation is inaccurate in suggesting that DMCs may "see" individually identifiable information. All such information is removed at Albertsons' server before it is transmitted to DMCs or any other third party. However, for purposes of this motion only, Albertsons treats this allegation as true.

3
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 13 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

identifies him, his claims amount to nothing more than speculation that some snippet of potentially identifying information slipped through the cracks. This is, of course, insufficient. To survive a Rule 12(b)(6) motion, a complaint must contain factual allegations sufficient "to raise a right to relief above the speculative level." Bell Atlantic Corp. v. Twombly, __ U.S. __, 127 S.Ct. 1955, 1965 (2007). A plaintiff's pleading obligation "requires more than labels and conclusions." Id. "It is no answer to say that a claim just shy of a plausible entitlement to relief can, if groundless, be weeded out early in the discovery process, given the common lament that the success of judicial supervision in checking discovery abuse has been on the modest side." Id. at 1967. Therefore, to state a claim for relief, plaintiff must allege facts, and those facts must do more than "merely create[] a suspicion [of] a legally cognizable right of action." Id. at 1965, quoting 5 C. Wright & A. Miller (3d ed. 2004), Federal Practice and Procedure § 1216 at 235-36. The courts also, of course, disregard legal conclusions in a pleading when ruling on motions to dismiss. Papasan v. Allain, 478 U.S. 265, 286 (1986); Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003)("[A court does] not . . . necessarily assume the truth of legal conclusions merely because they are cast in the form of factual allegations"). It is no mere technical defect that this complaint contains purely conclusory and speculative allegations that individual information is "inadequately de-identified." If the data is indeed anonymized (as other federal courts have recognized),5 then Plaintiff has no claim at all. Plaintiff cannot allege facts which would support his allegation of inadequate de-identification within the constraints of Rule 11. Twombly imposed the requirement of greater factual specificity because, among other reasons, defendants face crippling expense when courts allow "a potentially massive factual controversy to proceed." Twombly, 127 S.Ct. at 1967. Here, Plaintiff purports to act on behalf of an enormous class of Californians, asserting claims that, if permitted to proceed, would trigger voluminous and costly discovery. That spectre "will push cost-conscious defendants to settle even anemic cases before reaching those proceedings." Id. This Court should not allow that to happen. Instead, it should disregard this conclusory allegation and determine each of the legal issues below based on the premise
5 See discussion of IMS Health Corp. v. Ayotte, 490 F. Supp. 2d 163 (D.N.H. 2007), appeal pending, Case No. 07-1945 (1st Cir.), infra at 10-12.

4
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 14 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

that the data involved is de-identified (i.e., stripped of names, addresses, phone number and similar information) ­ as the original complaint alleged. B. The First Amended Complaint Fails to State a Claim for Violation of the CMIA 1. Background of the CMIA and its Legislative Intent

Subject to certain exceptions, the CMIA prohibits the use or disclosure of "medical information" without a patient's prior authorization. Civil Code §§ 56.10(a) and (d). "Medical information" is defined as "individually identifiable information." Civil Code § 56.05(g). "Individually identifiable information" is information which includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient's name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual's identity. Civil Code § 56.05(g) (emphasis added). Because the statute reaches only such "individually identifiable information," Plaintiff cannot establish a CMIA violation. Once medical data is deidentified, the information is what the CMIA calls "anonymiz[ed] data ­ information that does not disclose "individually identifiable information." Cal. Civ. Code § 56.10(c)(16). The CMIA simply does not govern the handling of de-identified data because, by definition, that data is not "individually identifiable information." This conclusion is supported not only by the plain language of the statute, discussed above, but also by its legislative history and case law. In 2003, the Legislature considered and debated amendments to the CMIA which added a proscription against the use of individually identifiable information for marketing (Civil Code Section 56.10(d)). These changes initially appeared in Assembly Bill 262 ("AB 262"). AB 262 contained two elements: (1) a marketing prohibition which eventually became part of Section 56.10(d), and (2) a proposed "Do Not Use" list, which would have protected participating physicians from sale of the same data at issue in this case. The first element of AB 262 was enacted in 2004, but the second element ­ the proposed "Do Not Use" list ­ was not enacted. Lowe Decl. ¶¶ 2-7 and Exhs. A-D. The proposal was that, if doctors placed their names on the "Do Not Use" list, pharmacies could not sell prescribing information about them to any third party. The "Do Not Use" portion of AB 262 died in Conference. Id., Exh. A. The Senate Committee 5
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 15 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

on Business and Professions considered this proposed legislation and concluded that the "Do Not Use" provisions did not belong in the CMIA: It seems clear that the CMIA was intended to apply to patient medical information and not physician prescription information which may or may not be made available to other persons or entities depending on the specified restrictions within [the "Do Not Use" portion of AB 262]. Lowe Decl. ¶ 5 and Exh. B. This legislative history confirms that the CMIA was never intended to govern the use or transfer of information which is not individually identifiable. Plaintiff cannot seriously contend that the CMIA prohibits the transfer of de-identified data since the California Legislature chose not to adopt legislation prohibiting this very practice. Finally, these conclusions are further corroborated by case law. Every California case interpreting and applying the CMIA has, without exception, involved the transmission of identifiable information to a third party, allegedly without consent. For example, in Colleen M. v. Fertility and Surgical Associates of Thousand Oaks, 132 Cal. App. 4th 1466 (2005), a fertility clinic disclosed a patient's medical history to her ex-fiancé in response to a subpoena; her medical and identifying information was disclosed. In Shaddox v. Bertani, 110 Cal. App. 4th 1406 (2003), a dentist disclosed to a police department his suspicions that a police officer was addicted to prescription pain medicine; his medical and identifying information was disclosed. Pettus v. Cole, 49 Cal. App. 4th 402 (1996), challenged an employer's use of psychiatric information about an employee to force him into an inpatient alcohol treatment program and ultimately to terminate his employment; his medical and identifying information was disclosed. These cases involve the type of communications the CMIA was intended to address. Not one reported case has involved de-identified information. Plaintiff's attempt to stretch the statute beyond its intended application is unavailing as the CMIA was simply not intended to address the conduct alleged in the First Amended Complaint. Thus, even accepting all allegations as true, the CMIA claim fails as a matter of law. 2. The CMIA's Disclosure Exceptions Permit the Conduct At Issue

As discussed above, the statute contains two prohibitions: disclosure (Section 56.10(a)) and use (Section 56.10(d)). Both of those prohibitions are subject to twenty-seven separate exceptions (or 6
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 16 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

"safe harbors"). Cal. Civ. Code § 56.10(b) and (c). Conduct that would otherwise be prohibited is permitted if one of the exceptions applies. Even if this Court were to conclude, notwithstanding the foregoing argument, that the CMIA extends to de-identified data, the conduct at issue falls within at least two of these exceptions. Section 56.10(c)(14) permits disclosures that are "otherwise specifically authorized by law," and Section 56.10(c)(16) allows the transfer of "anonymized" data. Both exceptions are discussed below. (a) Section 56.10(c)(16) Expressly Permits Using a Third Party to Encode, Encrypt or "Anonymize" Data to Remove Identifying Information Section 56.10(c)(16) provides: The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information. Cal. Civ. Code § 56.10(c)(16). Two things are apparent from Subdivision (c)(16). First, the plain text of this exception permits a third party to receive data in order to "anonymize" it ­ or, in the words of the First Amended Complaint, "have the information identifying individual patients removed" (FAC ¶ 12). Second, any further disclosure ­ i.e., a disclosure by the "anonymizer" to other third parties ­ must also avoid revealing individually identifiable information. This exception further confirms that the CMIA does not condemn the transfer of anonymized or "de-identified" data: it expressly allows covered entities to engage a third party to anonymize the data, and it also expressly permits those third parties to disclose that data to others, so long as it remains anonymized. Albertsons' earlier motion to dismiss argued that this exception is fatal to Plaintiff's CMIA claim. In response, Plaintiff has added a new allegation to respond to that argument: Defendants do not disclose Plaintiff and the Class' proprietary and confidential information to data mining firms such as IMS and Verispan for the purpose of encoding, encrypting, or otherwise anonymizing such information, as such information is disclosed to IMS and Verispan under contract(s) of sale for the purpose of developing marketing programs for pharmaceutical companies.

7
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 17 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

FAC ¶ 55 (emphasis added). This allegation does not eliminate the safe harbor provided by Subdivision (c)(16). Plaintiff alleges that either Albertsons or the DMCs de-identify the data (FAC ¶ 12). If Albertsons does so before it transmits the data to any DMC, then the CMIA does not apply at all, as the prior argument explains. If it is the DMCs who de-identify the data, then the first sentence of subsection 16 clearly permits them to do so, and the second sentence allows them in turn to disclose that anonymized data to others. Plaintiff apparently believes that the first sentence provides a safe harbor only when the de-identifier's role is to anonymize data and to do nothing else with it. Otherwise he would not now allege that Defendants disclose that data to DMCs for additional purposes (use for marketing programs). But the second sentence of Subdivision (c)(16) allows that data to be further disclosed "by the recipient" (the de-identifier) after it has been anonymized. If the de-identifier can encrypt the data but cannot do anything else with it, then the second sentence of Subsection (c)(16) is meaningless. Moreover, Plaintiff misreads this statute. Although his new allegation in Paragraph 55 closely tracks Subdivision (c)(16), there is one important distinction. Plaintiff uses the phrase "for the purpose of," while the statute uses the phrase "for purposes of." There is a substantive difference between the phrase "for the purpose of" and "for purposes of," as the latter denotes a more generalized connection between the conduct and the objective. See Church Divinity School of Pacific v. Alameda County, 152 Cal. App. 2d 496, 502 (1957)("`property used exclusively for . . . purposes of education' includes any facilities which are reasonably necessary for the fulfillment of a generally recognized function"). For these reasons, it is sufficient that the data was allegedly transferred to DMCs for deidentifying even if the de-identified data was later used for additional purposes. (b) Section 56.10(c)(14) Expressly Permits the Conduct Alleged in the First Amended Complaint Because It Is Authorized by the Privacy Rule Subdivision (c)(14) allows any disclosure which is otherwise specifically authorized by law. That subsection states: The information may be disclosed when the disclosure is otherwise specifically authorized by law, including, but not limited to, the voluntary reporting, either directly or indirectly, to the federal Food and 8
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 18 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Drug Administration of adverse events related to drug products or medical device problems. Cal. Civ. Code § 56.10(c)(14). This exception expresses the California Legislature's intent that the CMIA be applied in harmony with other state and federal regulations by providing an important safe harbor to its general prohibition on disclosures of medical information. "Subdivision (c)(14) thus serves as the residuary clause in Section 56.10. It legitimizes a myriad of situations the Legislature may not have cared to spell out, by establishing the principle of permissive disclosure when specifically authorized by law." Shaddox v. Bertani, 110 Cal. App. 4th 1406, 1414 (2003). The question presented in applying Subdivision (c)(14) is quite simply: does some other state or federal regulation specifically authorize the disclosure at issue? In Shaddox, the only case that has interpreted and applied Subdivision (c)(14), one of the "other laws" which authorized a disclosure was the San Francisco City Charter. The text of this subdivision and of Shaddox confirm that the "other law" need not be in the CMIA or even another California statute or regulation. In this case, the conduct alleged is specifically authorized by the HIPAA6 "Privacy Rule" promulgated by the Department of Health and Human Services ("HHS").7 Any entity to which HIPAA applies (including Defendants) may create information that is not individually identifiable health information by using "protected health information"8 to create de-identified health information. The information is no longer "protected health information" after it is de-identified. 45 C.F.R. § 164.502(d). Unless protected health information has been so de-identified, its use and disclosure is restricted in much the same manner as that data is restricted under the CMIA. See 45 C.F.R. § 164.502(a). Because Subdivision (c)(14) allows disclosures "otherwise specifically authorized by law,"

6 "HIPAA" is the federal Health Insurance Portability and Accountability Act. 7 HHS adopted the Privacy Rule pursuant to its "substantive lawmaking" authority granted by Congress and, as such, under California law the Privacy Rule is a "quasi-legislative rule" which has "the dignity of statutes." (RJN Ex. 2 at p. 53182, I(A) Para. 2 [67 Fed. Reg. 53182 (Aug. 14, 2002), codified at 45 C.F.R. pts. 160, 164]) See Yamaha Corp. of America v. State Bd. of Equalization, 19 Cal. 4th 1, 10, 11 (1998) (distinguishing substantive lawmaking from interpretative acts and observing that the former has "the dignity of statutes"). 8 "Protected health information" is the HIPAA equivalent of the CMIA's "individually identifiable information." It is so defined at 45 C.F.R. § 164.501.

9
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 19 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

including federal law, the sale of de-identified data alleged in the First Amended Complaint falls within the safe harbor of subdivision (c)(14). Therefore, even if the CMIA were deemed to apply to this conduct, the First Amended Complaint fails to state a violation of the statute. C. Even if the CMIA Were Read to Prohibit the Conduct At Issue, the First Amendment Prevents Its Application to Anonymized Data. Maine and New Hampshire attempted to regulate the sale of de-identified data. Both states' statutes failed to withstand First Amendment challenge. Accordingly, even if this Court were to conclude that the CMIA prohibits the sale of de-identified data, it should reach the same result as the two courts that have thoughtfully considered these constitutional challenges. In IMS Health Corp. v. Ayotte, 490 F. Supp. 2d 163 (D.N.H. 2007), appeal pending (1st Cir. Case No. 07-1945), IMS challenged New Hampshire's Prescription Information Law9 based on the First Amendment's guarantee of free speech. That statute barred pharmacies and other entities from transferring or using prescriber-identifiable data for certain commercial purposes. The federal court agreed with IMS that the statute unduly restrained commercial speech, and therefore issued a permanent injunction against enforcement of the law.10 More recently, the Maine federal district court relied on Ayotte to conclude that Maine's similar law was likewise unenforceable because of the First Amendment. IMS Health Corp. v. Rowe, 532 F. Supp. 2d 153 (D. Me. 2008), appeal pending (1st Cir. Case No. 08-1248). Because the Maine decision follows the logic of Ayotte, only Ayotte is addressed here.11 Both Rowe and Ayotte addressed the practices of the same DMCs whose business conduct is the subject of the First Amended Complaint in this case ­ IMS, Verispan, and others (FAC ¶¶ 14, 15). Following a detailed and instructive explanation about data mining and its use by pharmaceutical companies (490 F. Supp. 2d at 165-170), Ayotte concluded that the statute regulated

9 N.H. Rev. Stat. Ann. §§ 318:47-f, 318:47-g, and 318-B:12(IV)(2006). 10 Ironically, many passages in that lengthy decision appear almost verbatim in the Complaint filed in this action. The irony arises from the fact that Plaintiff would choose to plagiarize from a decision which establishes that his statutory claims do not survive First Amendment scrutiny. 11 Both cases are currently on appeal to the First Circuit, which heard oral argument in January 2008. Rowe is stayed pending that court's decision in Ayotte (1st Cir. Case No. 07-1945).

10
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 20 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

commercial speech. 490 F. Supp. 2d at 175. It therefore analyzed the constitutionality of the statute under the intermediate scrutiny standard established in Central Hudson Gas & Elec. Corp. v. Public Service Comm'n of New York, 447 U.S. 557, 564 (1980). Id. at 177. Under that standard, commercial speech restrictions are enforceable only if they support a substantial governmental interest, directly advance the interest asserted, and are not more extensive than necessary to serve that interest. The state Attorney General argued that the law was narrowly drawn and directly advanced the state's substantial interests in protecting prescriber privacy, promoting public health, and containing health care costs.12 IMS took issue with all three contentions and also argued that the law was invalid even if it was effective because its purposes could be achieved as well or better through alternatives that do not restrict speech. Id. Agreeing with IMS, the court quoted a Supreme Court comment that "[w]e have previously rejected the notion that the Government has an interest in preventing the dissemination of truthful commercial information in order to prevent members of the public from making bad decisions with the information." Id. at 181, quoting Thompson v. W. States Med. Ctr., 535 U.S. 357, 374 (2002). Albertsons may properly invoke the free speech rights of DMCs and pharmaceutical companies in response to this challenge to pharmacy data sales. The Supreme Court has broadened its general rules on standing in First Amendment cases to allow vendors who have suffered their own injuries to assert the rights of their customers, and vice versa. See Craig v. Boren, 429 U.S. 190, 194-95 (1976); Virginia State Board of Pharmacy v. Virginia Citizens Consumer Council, Inc., 425 U.S. 748, 756 (1976)(prescription drug purchasers have standing to challenge state restrictions on drug price advertising by pharmacists). Here, the injury Albertsons will suffer if data sales are prohibited will be (1) its own lost revenue from those sales and (2) any statutory penalties or other damages awarded to Plaintiff and the class. In sum, as noted above, the CMIA does not apply to the de-identified data here at issue. But even if this Court were to conclude otherwise, it should follow the lead of Ayotte and Rowe and conclude that the First Amendment precludes application of the CMIA to this form of speech.

12

Plaintiff's allegations mirror the last two of these claims. 11
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 21 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

D.

All Remaining Causes of Action Are Preempted by Federal Law In formulating and adopting the Department of Health and Human Services ("HHS")

regulations that established and provided for implementation of patient privacy requirements under HIPAA, HHS expressly recognized the crucial importance of de-identified health data to improving our healthcare system: There are many instances in which such individually identifiable health information is stripped of the information that could identify individual subjects and is used for analytical, statistical and other related purposes. Large data sets of deidentified information can be used for innumerable purposes that are vital to improving the efficiency and effectiveness of health care delivery, such as epidemiological studies, comparisons of cost, quality or specific outcomes across providers or payers . . . . Researchers and others often obtain large data sets with deidentified information from providers and payers (including public payers) to engage in these types of studies. This information is valuable for public health activities (e.g., to identify cost-effective interventions for a particular disease) as well as for commercial purposes (e.g., to identify areas for marketing new health care services). [65 Fed. Reg. at 59946 (emphasis added).] When HHS issued the HIPAA Privacy Rule in 2000, it declared that such uses of de-identified health data should be encouraged: A number of examples were provided of how valuable such de-identified information would be for various purposes. We expressed the hope that covered entities [i.e., entities subject to the Privacy Rule], their business partners, and others would make greater use of de-identified health information than they do today . . . . [65 Fed. Reg. 82462-01, 82543 (December 28, 2000)(emphasis added).] Consistent with that goal, HHS adopted detailed specifications in the Privacy Rule for de-identifying data. 45 C.F.R. § 164.514(b). De-identified data is not considered to be "individually identifiable health information," 45 C.F.R. § 164.514(a), and the Privacy Rule does not purport to restrict the use of health information unless it is "individually identifiable" ­ just like the CMIA. 45 C.F.R. §§ 164.502(a), (d). The Privacy Rule expressly preempts any inconsistent state law unless that law (1) relates to the privacy of individually identifiable health information and (2) is more stringent than the federal standards. 45 C.F.R. § 160.203.13 None of Plaintiff's second through ninth causes of action (1)

Section 160.203's prefatory text states that "[a] standard . . . adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law." Its remaining text states the exceptions to that rule of preemption. This reference to "State law" is broad 12
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

13

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 22 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

invokes statutes or common law principles which purport to focus on the privacy of health information, or (2) has anything to do with federal privacy standards, so none is "more stringent than" federal standards. To the extent that Plaintiff would apply them to de-identified data, they are therefore certainly preempted. Any other result would frustrate the federal goal that covered entities and their business associates will "make greater use of de-identified health information than they do today." See generally 65 Fed. Reg. 82543. Such greater use of de-identified information directly depends on the absence of state-imposed barriers on HIPAA-compliant de-identified information. Everyone involved in the health care industry, from health care providers to software developers to compliance officers and so on, will be able more efficiently to perform their jobs by focusing on a uniform set of standards for what constitutes de-identified information, rather than having constantly to keep track of an everevolving 50-state survey of the topic. E. The First Amended Complaint Fails to State a Cause of Action for Breach of Contract or the Implied Covenant of Good Faith and Fair Dealing 1. Elements of a Breach of Contract

"A cause of action for damages for breach of contract is comprised of the following elements: (1) the contract, (2) the plaintiff's performance or excuse of nonperformance, (3) the defendant's breach, and (4) the resulting damages to the plaintiff." Hsu v. OZ Optics, Ltd., 211 F.R.D. 615, 619 (N.D. Cal. 2002); Careau & Co. v. Security Pacific Business Credit, Inc., 222 Cal. App. 3d 1371, 1388 (1990). The First Amended Complaint fails to satisfy even these elementary requirements. 2. Plaintiff Has No Cognizable Damages

The complaint contains only general and conclusory allegations that Plaintiff and the class have been damaged. He newly alleges that his damages include the "significantly impaired value of his proprietary prescription information, the failure to receive compensation for its use by Defendants, and the past and future lost earnings his information would have yielded had he chosen to sell same."14

enough to encompass both Plaintiff's statutory and common law claims. Cipollone v. Liggett Group, 505 U.S. 504, 522 (1992). 14 It is ironic that Plaintiff professes his outrage that Defendants are selling his private information while he simultaneously complains that he would have sold that data himself but for the fact that Defendants have already done so. Id. and ¶ 46 ("Plaintiff's ability to sell his property interest 13
MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED COMPLAINT CASE NO. 08-CV-1173

Case 3:08-cv-01173-H-CAB

Document 18-2

Filed 08/14/2008

Page 23 of 39

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

FAC ¶ 28. He also repeatedly claims that his medical information is his "property" (e.g., FAC ¶¶ 9-10 at 4:16-24). However, his individual medical information has no value, and he has no property interest in that data. He therefore has no cognizable damages. Plaintiff cannot assert that he has lost "property" by virtue of Defendants' sales of prescription data. While Plaintiff's doctors might have a property interest in data which reveals their prescribing habits, there is no basis for suggesting that any anonymous patient has such an interest in that data. The few cases which have considered similar questions have refused to recognize a property right in personal information ­ even though those cases, unlike this one, did involve sales of personally identifying information. Thompson v. Home Depot, Inc., 2007 U.S. Dist. LEXIS 68918 at *8 (S.D. Cal. September 18, 2007)(Gonzalez, C.J.)(rejecting plaintiff's claim that his personal information, used by defendant for marketing purposes, is "property"), citing In re Jetblue Airways Corp. Privacy Litigation, 379 F. Supp. 2d 299, 327 (E.D.N.Y. 2005)("There is . . . no support for the proposition that an individual passenger's personal information has or had any compensable value in the economy at large"), and Dwyer v. American Express Co., 652 N.E.2d 1351, 1356 (Ill. App. 1995)(individual names have "little or no intrinsic value to . . . a merchant"). Accord: In re Trans Union Corp. Privacy Litigation, 326 F. Supp. 2d 893, 902-03 (N.D. Ill. 2004)(individual plaintiffs' names have no intrinsic value); Shibley v. Time, Inc., 341 N.E.2d 337, 340 (Ohio App. 1975); U.S. News & World Report, Inc. v. Avrahami, No. 95-1318, 1996 Va. Cir. LEXIS 518, at 5 (Va. Cir. June 13, 1996). And see Moore v. Regents of the University of California, 51 Cal. 3d 120, 136-39 (1990)(denying plaintiff property rights in his body and his biological information). In re Jetblue, supra, is noteworthy because there, as here, plaintiffs asserted that they provided their personal information to JetBlue only for the specific purpose of buying an airplane ticket, and that they did so on the promise that their personal information woul