Doe I v. Google LLC

Background

The plaintiffs moved for a preliminary injunction, which is temporary relief issued while a case is pending. They sought relief concerning Google’s acquisition of private health information through Google source code placed on health care provider web properties. The plaintiffs asserted claims under the Electronic Communications Privacy Act (ECPA), the California Invasion of Privacy Act (CIPA), California privacy law, and California’s Unfair Competition Law (UCL). The court also denied the plaintiffs’ motion to appoint interim lead counsel and a lead plaintiff.

The plaintiffs presented evidence that Google acquired health information and could use it for its own purposes. But the court found they had not presented evidence that Google actually connected the information to specific patients or used the information itself. The court excluded a rebuttal declaration from Dr. Zubair Shafiq because it was submitted with the reply and contained almost 600 pages of new evidence. The court said rebuttal evidence may contradict or reduce the effect of an opposing party’s evidence, but may not introduce new arguments or evidence.

Preliminary-injunction standard

The court described a preliminary injunction as an extraordinary remedy requiring substantial proof and a clear showing by the moving party. The plaintiffs had to show a likelihood of success on the merits, or at least serious questions going to the merits, along with a balance of hardships sharply favoring them and consistency with the public interest.

The parties disagreed about whether the requested injunction was mandatory or prohibitory. A mandatory injunction requires affirmative action, while a prohibitory injunction generally prevents conduct. The court assumed the request was for a prohibitory injunction because that classification carries a lighter burden, but concluded that the plaintiffs had not met even that burden.

Claims and likelihood of success

ECPA claim. The court found that the plaintiffs had not shown a likelihood of success because the ECPA generally permits an interception when one party to the communication has given prior consent. The health care providers had consented to Google’s source code being used on their web properties, even though the plaintiffs had not consented to Google receiving their health information. The plaintiffs argued that an exception applied when an interception is made to commit a criminal or tortious act. The court concluded that they had not provided enough evidence that Google’s purpose in intercepting the communications was criminal or tortious. The court explained that the interception must be intended to facilitate some further improper act, not merely be an interception that itself violated the law.

CIPA claim. The court said the CIPA claim might be the plaintiffs’ strongest claim. Unlike the ECPA, CIPA does not contain a one-party-consent exception and requires consent from all parties to the communication. The plaintiffs presented evidence that they did not consent to Google obtaining their health information. Google argued that it was only a vendor providing software services to health care providers. Based on the evidence submitted for the motion, the court said Google might fit either the category of an independent party mining and selling information or the category of a vendor capturing and hosting a client’s data, but the answer was not clear.

Privacy claims. The court recognized a reasonable expectation of privacy in private health information. But it found it unclear whether Google’s conduct was highly offensive, particularly without evidence that Google itself used the information. The court said that issue could depend on a better understanding of Google’s role, including whether it acted as a vendor under CIPA.

UCL claim. The UCL requires a plaintiff to have lost money or property and therefore to show economic injury. The court said it was unsettled whether disclosure of personal information or data constitutes economic injury, so the plaintiffs had not shown a clear likelihood of success on this claim.

Hardships and public interest

Even assuming the plaintiffs had raised serious merits questions and suffered some irreparable injury from Google’s acquisition of their information, the court found that they had not shown that the hardships sharply favored an injunction or that an injunction would serve the public interest. The absence of evidence that Google used the information for its own purposes weakened the plaintiffs’ showing. The proposed injunction would substantially burden Google and potentially the health care companies with which it worked.

Disposition and next steps

The court denied the plaintiffs’ motion for a preliminary injunction and denied their motion to appoint interim lead counsel and a lead plaintiff. The court did not issue the requested temporary relief. It stated that, after the merits issues had been explored through the injunction motion, the plaintiffs could seek permission to file an amended complaint by administrative motion within seven days. The court said it would grant permission absent extraordinary circumstances presented by Google. If the plaintiffs did not amend, the court would likely schedule another hearing before deciding Google’s pending motion to dismiss.