The U.S. Court of Appeals for the Ninth Circuit recently issued a decision that could have significant consequences for data privacy cases going forward. The class action is getting a lot of attention from legal experts and generating major headlines, such as “Black v. IEC Group: Important Data Privacy Ruling.” That’s because the federal appellate court reversed a lower court decision and held that a plaintiff can have Article III standing to sue even when the only harm alleged is the unauthorized disclosure of sensitive data. The precedent set here could make it easier for plaintiffs to withstand pre-trial motions to dismiss in other types of data privacy cases, including California Invasion of Privacy Act (CIPA) claims and intrusion upon seclusion claims alleging a faulty consent banner.
To learn more about Black v. IEC Group, Inc., and the implications for California data breach cases and data privacy claims, keep reading.
AmeriBen Sued for Disclosing Patient Health Information in Data Breach
IEC Group is more commonly known as AmeriBen, which is a third-party administrator (TPA) that assists companies with processing of employee health plans and medical benefits. AmeriBen works with more than 175 employers in the United States to administer benefits to company workforces.
The plaintiffs in Black v. IEC Group, Inc. are Miles Black and Melissa Black, both of whom received health insurance benefits from a plan administered by AmeriBen. This case did not involve a traditional data breach incident, such as a computer hacker illegally accessing a database and stealing confidential information. Rather, an employee of the health insurance plan administrator accidentally emailed a spreadsheet to several health plan members. This spreadsheet reportedly contained:
- Patient names.
- Unique tracking numbers.
- Health insurance provider names.
- Health insurance claim numbers.
- Dates of service.
- Dollar amounts billed.
Notably, the plaintiffs alleged that IEC Group (AmeriBen) required them to provide their sensitive health information as a condition of signing up for health insurance.
Lawsuit: AmeriBen Privacy Policy Promised to Safeguard Customer Health Information
According to the class action lawsuit, AmeriBen had a Privacy Policy that both expressly and implicitly promised to keep the plaintiffs’ health information confidential and to not disclose the information to anyone without permission. Further, the Privacy Policy allegedly included a promise from the health insurance benefits administrator to take reasonable steps to prevent any unauthorized disclosures.
When AmeriBen disclosed the plaintiffs’ health data, the company breached their promises and effectively violated their agreement with the plaintiffs. This prompted a class action lawsuit in the U.S. District Court for the District of Idaho. However, the lower court initially dismissed the complaint for lack of subject matter jurisdiction. Specifically, the court held that the plaintiffs did not have Article III standing to sue because they failed to establish an actionable injury that would allow the class action to proceed.
What Is Article III Standing to Sue?
In order to file a civil suit in federal court, a plaintiff must have standing to sue under Article III of the United States Constitution. This is a minimum threshold requirement for plaintiffs to show that (1) they suffered a concrete injury in fact; (2) the defendant’s conduct caused that injury; and (3) the court will be able to remedy that injury.
A common defense raised at the pre-trial pleading stage in data breach and data disclosure cases is that the plaintiff did not suffer a concrete, particularized injury, such as damages from identity theft or monetary losses. In Black v. IEC Group, Inc., the Ninth Circuit Court of Appeals placed significant limits on that defense by holding that plaintiffs whose sensitive health data was disclosed without consent can bring a lawsuit even when there was no financial loss associated with the unauthorized disclosure. In other words, an unauthorized data disclosure is, by itself, enough to establish Article III standing to sue.
Tauler Smith Wins Article III Rulings in California Data Privacy Claims
It is common practice for defendants in data privacy cases to file a motion to dismiss for lack of Article III standing. The Los Angeles data privacy lawyers with Tauler Smith LLP have successfully defeated motions to dismiss in several of these cases.
- Conohan v. Rad Power Bikes: Tauler Smith attorneys won a pre-trial argument that a California consumer had Article III standing to sue an electric bicycle company because the plaintiff suffered a particularized injury when the defendant used TikTok tracking code to monitor website visitors’ online activity.
- Hassid v. Alex and Ani LLC: Tauler Smith litigators successfully argued during the pre-trial stage that the plaintiffs in a data privacy class action against jewelry retailer Alex and Ani had Article III standing to sue.
- Cammorata v. P39 Tech LLC: Tauler Smith attorneys secured a favorable judgment in a data privacy case against digital advertising company Peer39 after an expert witness testified that the Peer39 website’s cookie consent banner was ineffective and ignored user requests to opt out of online tracking.
AmeriBen Filed a Motion to Dismiss Lawsuit Alleging Unauthorized Disclosure of Customers’ Health Data
In Black v. IEC Group, Inc., defendant AmeriBen filed a Rule 12(b)(1) motion to dismiss the lawsuit for lack of subject matter jurisdiction. AmeriBen argued that the data privacy claim should be rejected before trial because the plaintiffs did not suffer an injury in fact and therefore lacked Article III standing. The court subsequently granted the motion to dismiss, finding that the plaintiffs needed to show that the defendant’s disclosure of their personal information created an imminent and substantial injury. According to the lower court, this would have included facts about the type of personal information that was disclosed, the context of the disclosure, and other injuries stemming from the disclosure.
Ninth Circuit Court Allows Data Privacy Class Action Against AmeriBen to Proceed
The Ninth Circuit Court reversed the lower court ruling.
The appellate court held that when a consumer entrusts a company like AmeriBen with sensitive personal information, and the company later discloses that information without consent, the consumer suffers a clear injury. In fact, the court explicitly stated that “a trust betrayed is the harm.” The court added that the abuse of that trust is sufficient to establish standing to sue because the harm goes “beyond concerns of property or due process.” No other harm was necessary for the data privacy claim against IEC Group to proceed.
Furthermore, the court likened the defendant’s privacy violation to a breach of contract or breach of confidence claim. In fact, this may be the first Ninth Circuit opinion that relies on “breach of confidence” as the basis for Article III standing.
Other courts have also found that there is a substantive right to privacy for consumers. For instance, the California Northern District Court held in Pemberton v. Restaurant Brands International, Inc. that the plaintiff had Article III standing to sue because any violation of statutorily protected privacy rights can cause a concrete injury.
Congressional Intent to Safeguard Sensitive Health Information Against Data Breaches
Although the ruling in Black v. IEC Group, Inc. is applicable more broadly to other types of data privacy and data breach claims, the particular facts of the case concern sensitive health information. This type of data can be particularly valuable, as evidenced by Healthline’s $1.55 million settlement over online privacy claims. The digital health advice publisher agreed to pay the largest monetary penalty ever issued for alleged violations of California state data privacy laws. The settlement recognized the inherent value of consumers’ personal health information, including the substantial revenues generated by targeted advertisements on the healthline.com website.
In the recent case against AmeriBen, the Ninth Circuit Court pointed to congressional intent as justification for the data privacy lawsuit. According to the court, the Health Insurance Portability and Accountability Act (HIPAA) was originally passed to protect patients against the unauthorized disclosure of their sensitive health information. In fact, noted the court, HIPAA imposes criminal liability on individuals who knowingly disclose this type of information. The statutory protections provided by HIPAA may not apply in a CIPA claim or other civil action, but they still make it clear that health data is extremely important – and the breach of trust from a disclosure of sensitive health data is enough for Article III standing in a civil suit.
What Are the Consequences of Black v. IEC Group for Data Privacy Claims in California?
Although the court in Black v. IEC Group mentioned the nature of the sensitive health information that was disclosed, the ruling could be applicable to other cases that don’t necessarily involve health data. This may include California Invasion of Privacy Act claims stemming from a website’s faulty consent banner. That’s because when a website operator makes certain promises about not tracking visitors, but then breaches those promises, it creates the type of “intangible injury” that is analogous to an injury caused by a breach of confidence.
This recalls the pre-trial ruling in Pemberton v. Restaurant Brands International, Inc. Defendant Burger King was accused of violating the California Invasion of Privacy Act (CIPA) by installing a faulty cookie consent banner on its website and collecting site visitors’ data without consent. A federal court denied a motion to dismiss and held that California consumers have a protectable privacy interest in different types of personal information, including their online activity.
Ninth Circuit Court: Companies Must Fulfill Promises Made by Their Privacy Policies
Another important lesson from the ruling in Black v. IEC Group, Inc. is that companies must fulfill the promises made by their privacy policies – or risk liability in a data privacy lawsuit. This is especially important when the privacy policy is relied on by a lot of people – such as visitors to a commercial or retail website – because a company’s failure to follow their own privacy policy could lead to individual civil suits or even a class action.
Another important consequence of the federal appellate court’s ruling is that consumers whose personal data is shared without consent do not need to wait until their data is used – and they become the victim of identity theft – before filing a lawsuit.
Contact the California Data Privacy Attorneys at Tauler Smith LLP
Are you a California resident who visited a website or used social media? If so, it’s possible that your data was collected without consent and shared with third parties. The experienced Los Angeles data privacy lawyers at Tauler Smith LLP can take legal action to stop the offending company from sharing your personal information. We can also help you get financial compensation. Our trial attorneys represent plaintiffs in data privacy cases in both state and federal courts, and we have a strong reputation among our legal peers for winning these cases.
Call 310-590-3927 or email us today.
