470 F.Supp.3d 534
D.S.C.2020Background
- Plaintiffs (South Carolina residents and Walgreens pharmacy customers) sued Walgreen Co. and parent Walgreens Boots Alliance, Inc. (WBA), alleging Walgreens used, disclosed, and monetized customers’ personally identifiable information (PII) through a corporate program called 340B Complete.
- Plaintiffs allege Walgreens copies pharmacy PII from store software (IntercomPlus) into a corporate Enterprise Data Warehouse (EDW); 340B Complete scans EDW to identify patients tied to Covered Entities and facilitates 340B drug purchases and administration, allegedly generating profits.
- Plaintiffs claim ~160 non‑pharmacy 340B employees (not licensed pharmacists) had unauthorized access to PII and that Walgreens’ Notice of Privacy Practices did not disclose 340B Complete use.
- Amended complaint asserted multiple claims (privacy/invasion of privacy, FCRA, negligence per se under HIPAA/FTCA/PIPA, breach of contract, negligence, unjust enrichment, declaratory relief, and related theories).
- Walgreens moved to dismiss the amended complaint and to dismiss WBA for lack of personal jurisdiction; the court granted dismissal of WBA for lack of jurisdiction and dismissed all asserted claims against the remaining defendant, Walgreen Co.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Personal jurisdiction over WBA (waiver/alter‑ego) | WBA participated in litigation and should be bound; WBA is alter ego of Walgreen Co. because Retail Pharmacy USA is a WBA division and executives/operations overlap | WBA preserved jurisdictional defense timely; Walgreen Co. (not WBA) operates SC pharmacies; parent/subsidiary distinctions preclude jurisdiction | WBA did not waive defense; alter‑ego not shown (plaintiffs failed to plead all four alter‑ego factors); WBA dismissed for lack of personal jurisdiction |
| FCRA claim | Plaintiffs alleged unlawful data handling implicates FCRA | Walgreen Co. not a consumer reporting agency; PII here not a consumer report; plaintiffs failed to oppose in brief | FCRA claim abandoned/dismissed |
| Wrongful appropriation (invasion of privacy) | Using PII without consent for corporate benefit is wrongful appropriation; publicity not required | Claim requires publicity/right of publicity; no public dissemination alleged | Dismissed for failure to allege publicity/right‑of‑publicity element |
| Wrongful publicizing of private affairs | EDW access by many employees equates to publicizing private facts | Access by employees is internal; publicity requires communication to public at large or equivalent | Dismissed for failure to allege publicity (internal access ≠ public dissemination) |
| Negligence per se (HIPAA and FTCA) | Violations of HIPAA/FTCA support negligence per se | HIPAA/FTCA do not confer private cause of action; plaintiffs did not plead statutory elements or the kind of violations alleged | Dismissed: plaintiffs failed to plead private right (and did not sufficiently allege FTCA violation facts); HIPAA cannot be the basis for negligence per se here |
| Negligence per se (PIPA) | PIPA prohibits transfers of prescription information without consent and supports negligence per se | PIPA does not create a private cause of action; statute prohibits external transfers to other persons/entities, not internal database transfers within a pharmacy corporate entity | Dismissed: court interprets PIPA to target external transfers; plaintiffs’ allegations concern internal transfers and fail to state a PIPA violation |
| Breach of contract (implied, insurance, NPP) | Plaintiffs impliedly contracted for confidentiality when purchasing prescriptions; NPPs/insurer arrangements create contractual duties | No mutual assent to essential terms for an implied contract; NPPs are not contracts; plaintiffs lack standing to enforce insurer contracts | Dismissed for failure to identify enforceable contract terms or mutual assent |
| Negligence and professional‑standard claims (including PPA) | Walgreens breached duties from professional standards, PPA, and Board of Pharmacy rules to protect PII | Plaintiffs failed to plead existence of a legal duty recognized in SC (no common law duty of confidentiality for pharmacists) and failed to show PPA creates a private right or duty here | Dismissed for failure to plead a duty; PPA/HIPA cannot be treated as standalone negligence without alleging duty/private right |
| Respondeat superior / negligent training & supervision | Employer liable for employees’ acts and for negligent supervision/training | Respondeat superior is not an independent cause; negligent supervision claim requires allegation that an employee intentionally harmed another | Respondeat superior dismissed as not a cause of action; negligent supervision/training dismissed for failure to plead requisite facts (intentional harm theory not alleged) |
| Unjust enrichment | Walgreens benefitted (profits) from use of PII; inequitable for it to retain benefit | Plaintiffs had no reasonable expectation of payment; no sufficiently pleaded benefit conferring an unjust enrichment scenario | Dismissed: plaintiffs failed to allege an expectation/benefit under South Carolina unjust enrichment standards |
| Declaratory judgment | Plaintiffs seek declaration about Walgreens’ privacy practices | Declaratory relief depends on an actual, justiciable controversy tied to other claims | Dismissed as derivative of dismissed claims; no independent justiciable controversy |
Key Cases Cited
- In re Celotex Corp., 124 F.3d 619 (4th Cir. 1997) (plaintiff bears burden to show personal jurisdiction; prima facie when no evidentiary hearing)
- Mylan Labs., Inc. v. Akzo, N.V., 2 F.3d 56 (4th Cir. 1993) (standard for prima facie personal jurisdiction on motion)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (U.S. 2007) (complaint must plead plausible claim)
- Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (plausibility pleading standard)
- Builder Mart of Am., Inc. v. First Union Corp., 563 S.E.2d 352 (S.C. Ct. App. 2002) (four‑factor alter‑ego test in South Carolina)
- Gignilliat v. Gignilliat, Savitz & Bettis, L.L.P., 684 S.E.2d 756 (S.C. 2009) (discussing wrongful appropriation/right of publicity in South Carolina)
- Sloan v. S.C. Dep’t of Pub. Safety, 586 S.E.2d 108 (S.C. 2003) (three invasion‑of‑privacy torts described)
- Swinton Creek Nursery v. Edisto Farm Credit, ACA, 514 S.E.2d 126 (S.C. 1999) (distinguishing publication from publicity; publicity requires dissemination to public at large or equivalent)
- Evans v. Rite Aid Corp., 478 S.E.2d 846 (S.C. 1996) (no common‑law pharmacist confidentiality duty recognized)
- MedImmune, Inc. v. Genentech, Inc., 549 U.S. 118 (U.S. 2007) (actual‑controversy requirement for declaratory relief)
- Provident Life & Acc. Ins. Co. v. Waller, 906 F.2d 985 (4th Cir. 1990) (factors considered in equitable unjust enrichment/quasi‑contract analysis)