Lynch v. Express Scripts Holding Company

Background

Jonathan Lynch brought a proposed class action based on his use of Express Scripts’ online pharmacy website. He alleged that the website used Facebook Pixel, code that sent information about his interactions with the website to Facebook in real time. According to the allegations, the information included pages viewed, clicks, keystrokes, search items, information entered, and other website activity.

Lynch alleged that he used the website to obtain prescriptions for low insulin and testosterone levels and entered identifying, payment, insurance, and diagnosis information. He alleged that Express Scripts shared this information with Facebook without his consent. He asserted claims under the federal Wiretap Act, the California Invasion of Privacy Act, and the California Confidentiality of Medical Information Act.

Judicial Notice and Incorporation by Reference

Express Scripts asked the court to take notice of documents including Express Scripts’ registration materials, privacy policy, terms of use, Meta’s privacy and cookie policies, and Facebook help-center materials. The court took judicial notice of the existence of the documents but did not consider matters beyond that. It also declined to treat the documents as part of the complaint through incorporation by reference.

Wiretapping Claims

Express Scripts moved to dismiss the second amended complaint, arguing that Lynch failed to meet pleading requirements, consented to the data collection, and failed for other claim-specific reasons. The court concluded that Lynch’s allegations remained inconsistent about who intercepted the communications. Some allegations attributed the interception to Facebook, while others attributed it to Express Scripts.

The court held that this inconsistency failed to give Express Scripts fair notice of the conduct underlying the federal and state wiretapping claims. It therefore granted the motion to dismiss as to those claims. The court found that, apart from this deficiency, Lynch’s allegations generally satisfied the basic pleading requirement under Federal Rule of Civil Procedure 8. It also rejected Express Scripts’ argument that Lynch had to provide additional technical details at the motion-to-dismiss stage and rejected the argument that the claims were subject to the heightened fraud-pleading rule in Rule 9(b).

The court allowed Lynch one final opportunity to cure the inconsistent allegations by filing a third amended complaint within 21 days of the order.

Medical-Information Confidentiality Claim

The California Confidentiality of Medical Information Act requires covered entities, including pharmaceutical companies, to preserve the confidentiality of medical information. The court held that Lynch plausibly alleged that he provided medical information to Express Scripts because he alleged that he entered information concerning prescriptions, medical conditions, and diagnosis history, along with identifying information.

The court also held that Lynch plausibly alleged disclosure of that medical information. His allegations that Express Scripts deployed Facebook Pixel and that the Pixel transmitted private communications to Facebook were sufficient at the pleading stage.

The court rejected Express Scripts’ argument that Lynch failed to allege that an unauthorized party actually viewed the information. Considering the allegations in Lynch’s favor, the court found it reasonable to infer that Meta viewed the intercepted information while building user profiles for its advertising products. The court stated that discovery could test that inference but held that the claim could proceed at this stage.

The court also rejected Express Scripts’ consent argument. It held that the generalized disclosures about website-enhancement technology, pixels, data sharing, site functionality, and marketing were not enough to establish consent as a matter of law at the pleading stage. The court likewise found that Meta’s general policies did not specifically disclose the alleged sharing of sensitive health information. It therefore denied the motion to dismiss the medical-information confidentiality claim based on disclosure, actual viewing, and consent.

Disposition

Judge Araceli Martinez-Olguin concluded that Express Scripts’ motion to dismiss was granted in part and denied in part. Lynch may file a third amended complaint within 21 days to cure the specified pleading deficiencies. The order states that he may not otherwise add new claims, parties, or substantive allegations.