IN THE UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF PENNSYLVANIA
JOHN DOE, individually, as : CIVIL ACTION NO. 1:24-CV-547 personal representative of the : estate of Jane Doe, and on behalf : (Judge Neary) of all others similarly situated, : : Plaintiff : : v. : : POST ACUTE MEDICAL, LLC, : d/b/a PAM HEALTH, et al., : : Defendants :
MEMORANDUM
Plaintiff John Doe brings state-law claims of negligence, invasion of privacy, breach of contract, unjust enrichment, breach of fiduciary duty, unfair trade practices, and wiretapping and electronic surveillance against his late wife’s former medical providers, defendants Post Acute Medical, LLC, and PAM Health, LLC. Defendants now move to dismiss the complaint for failure to state a claim pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure. The motion is granted in part and denied in part. I. Factual Background & Procedural History Post Acute Medical, LLC, is a Delaware entity with its principal place of business in Enola, Pennsylvania. (See Doc. 1-1 ¶ 30). PAM Health, LLC, is a Pennsylvania entity that also maintains its principal place of business within the Commonwealth. (See id. ¶ 31). These defendants operate a “national medical system which owns and operates medical facilities” in several states, employs 7,500 people, and generates approximately $890 million in annual revenue. (See id. ¶¶ 35-36). They provide a wide range of services, including hospital, rehabilitation, outpatient treatment, and home health and hospice services. (See id. ¶ 37). Like
many healthcare providers, defendants maintain an online platform and website, which provide, among other resources: a search function for medical conditions, physicians, and treatment locations; a health blog; and a patient portal, where users may access their treatment course, communicate with treating professionals, upload documents, and pay bills. (See id. ¶ 45). John Doe is an Ohio resident whose late wife, Jane Doe, received treatment at one of defendants’ facilities, the PAM Health Specialty Hospital of Dayton, Ohio,
starting at some point in 2020 and ending prior to her death in March 2021. (See id. ¶¶ 29, 121-123). Mrs. Doe suffered from blood cancer, Atypical hemolytic uremic syndrome (aHUS), and kidney issues, requiring, among other treatments, ventilation, coma care, and wound care. (See id. ¶¶ 121, 123). During his wife’s treatment, John Doe used defendants’ website and patient portal to research treatments and specialists, communicate with doctors, and request information
from care providers. (See id. ¶ 123). He claims he did so both of his own accord and on behalf of his wife, and that defendants collected the Does’ private information and disseminated it to Meta and other third parties without their consent. (See id. ¶¶ 121-127). Consequently, Doe “now receives targeted health-related advertisements reflecting private medical treatment information, including those related to skin conditions, arthritis, geriatric medical conditions, as well as for clinical trials, and physicians,” (see id. ¶ 129), and he has experienced embarrassment, humiliation, frustration, emotional distress, and devaluation of his private information, (see id. ¶ 131). The crux of Doe’s allegations is that defendants installed certain software programs on their website, called pixels,1 which collect users’ personal and health
information and transmit it to Meta, Google, Microsoft, MarketingCloudFX, and “potentially other[]” unidentified third parties. (See id. ¶ 1; see also id. ¶ 76 (additional list of potential third-party recipients); ¶ 88 (same); ¶ 115 (same)). These pixels, according to the complaint, collect information—including user cookies, IP Address, pages viewed, buttons clicked, patient status, search terms, treatment facilities, and treatments rendered, which included, in Mrs. Doe’s case, information
related to wound care as well as kidney, blood, and respiratory conditions. (See id. ¶¶ 123, 126; see also id. ¶ 160 (allegation related to IP Address)).2 Doe alleges that this allowed the recipient of the information, namely Meta/Facebook, to discern the medical conditions for which a specific patient sought treatment, though Facebook could only link the information to a unique individual if the user accessed
1 These programs include Meta Pixel, Google Analytics with Google Tag Manager (“GTM”), and “likely others,” (see id. ¶ 8), such as MarketingCloudFX, Facebook Events, Microsoft Clarity, and Double Click, (see id. ¶ 93). 2 Doe’s complaint includes factual allegations that the Meta pixel tracker automatically collects and transmits certain information, such as the URLs visited, metadata, and button clicks, regardless of defendants’ particular configuration of the tool at the time of the alleged violations. (See id. ¶ 51). The complaint also includes details regarding the maximum amount of information the Meta pixel could collect if configured to its fullest capabilities and alleges that defendants took advantage of the software’s most expansive version. (See id. ¶¶ 56-57, 113). defendants’ systems using a devise from which they previously had accessed their Facebook account. (See id. ¶¶ 18-19; see also id. ¶¶ 67, 105, 164). Doe further contends that defendants “utilized data from these trackers to
market [their] services and bolster [their] profits” in part by creating “targeted advertisements” based upon users’ medical conditions. (See id. ¶¶ 16-17; see also id. ¶ 46). These practices, Doe avers, violated defendants’ clickwrap-style notice of privacy practices and terms of use policy. (See id. ¶¶ 77-87; see also Doc. 1-1 Ex. B (notice), Ex. C (terms of use policy)). Doe brings Pennsylvania state-law claims of negligence (Count I), (see Doc. 1-1 ¶¶ 197-205); invasion of privacy, both intrusion upon seclusion (Count II),
(see id. ¶¶ 206-215), and public disclosure of private facts (Count III), (see id. ¶¶ 216- 222); breach of implied contract (Count IV), (see id. ¶¶ 223-233), and, in the alternative, unjust enrichment (Count V), (see id. ¶¶ 234-241); breach of fiduciary duty (Count VI), (see id. ¶¶ 242-248); unfair trade practices in violation of Pennsylvania’s Unfair Trade Practices and Consumer Protection Law (“UTPCPL”), 73 PA. CONS. STAT. ANN. § 201 et seq., (Count VII), (see Doc. 1-1 ¶¶ 249-263); and
wiretapping and electronic surveillance in violation of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”), 18 PA. CONS. STAT. ANN. § 5701 et seq., (Count VIII), (see Doc. 1-1 ¶¶ 264-277). He does so individually, as representative of his late wife’s estate, and on behalf of a putative class.3
3 The proposed class includes “[a]ll Persons whose Private Information was disclosed by Defendants to third parties through the Metal Pixel and related technology without authorization.” (See Doc. 1-1 ¶ 182). Doe initially filed this action in the Court of Common Pleas of Cumberland County on March 8, 2024. (See Doc. 1-1 at 2-3). Defendants subsequently invoked our diversity jurisdiction under the Class Actions Fairness Act of 2005 (“CAFA”),
28 U.S.C. § 1331(d), by filing a timely notice of removal. See 28 U.S.C. § 1446; (see also Doc. 1 ¶¶ 9-32 (jurisdictional averments in defendants’ notice of removal)). Defendants now move to dismiss Doe’s complaint pursuant Federal Rule of Civil Procedure 12(b)(6). The motion is fully briefed and ripe for disposition. II. Legal Standards Rule 12(b)(6) of the Federal Rules of Civil Procedure provides for the dismissal of complaints that fail to state a claim upon which relief may be granted.
See FED. R. CIV. P. 12(b)(6). When ruling on a motion to dismiss under Rule 12(b)(6), the court must “accept all factual allegations as true, construe the complaint in the light most favorable to the plaintiff, and determine whether, under any reasonable reading of the complaint, the plaintiff may be entitled to relief.” Phillips v. County of Allegheny, 515 F.3d 224, 233 (3d Cir. 2008) (quoting Pinker v. Roche Holdings, Ltd., 292 F.3d 361, 374 n.7 (3d Cir. 2002)).
Federal notice and pleading rules require the complaint to provide “the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Phillips, 515 F.3d at 232 (alteration in original) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)). To test the sufficiency of the complaint, the court conducts a three-step inquiry. See Santiago v. Warminster Township, 629 F.3d 121, 130-31 (3d Cir. 2010). In the first step, “the court must ‘tak[e] note of the elements a plaintiff must plead to state a claim.’” Id. at 130 (alteration in original) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 675 (2009)). Next, the factual and legal elements of a claim must be separated; well-pleaded facts are accepted as true, while mere legal conclusions may be disregarded. Id. at 131-32; see Fowler v. UPMC Shadyside,
578 F.3d 203, 210-11 (3d Cir. 2009). Once the court isolates the well-pleaded factual allegations, it must determine whether they are sufficient to show a “plausible claim for relief.” Iqbal, 556 U.S. at 679 (citing Twombly, 550 U.S. at 556); Twombly, 550 U.S. at 556. A claim is facially plausible when the plaintiff pleads facts “that allow[] the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. III. Discussion
Defendants seek dismissal of Doe’s complaint in its entirety. (See generally Doc. 12). Each claim is discussed in turn. A. The Claims Advanced on Behalf of Mrs. Doe’s Estate Must Be Dismissed as Untimely. Defendants first argue that the claims advanced on behalf of Mrs. Doe’s estate are untimely under the applicable survival statute of limitations. (See Doc. 13 at 5-6).4 Federal Rule of Civil Procedure 8(c) classifies a statute-of-limitations claim as an affirmative defense that must be pled in an answer to the complaint. See FED. R. CIV. P. 8(c). Regardless, the court may dismiss a complaint as time-barred under
4 Defendants assert that all claims may be characterized as on behalf of Mrs. Doe’s estate because Doe accessed defendants’ website “on behalf of his wife.” (See Doc. 13 at 5 (citing Doc. 1-1 ¶¶ 123-124, 126)). However, it is plausible, if not probable, that some of the data allegedly transmitted—including IP Address—were those of Mr. Doe. The claims of Mrs. Doe’s estate and those of Mr. Doe warrant separate consideration. Rule 12(b)(6) pursuant to the so-called “Third Circuit Rule” if “the time alleged in the statement of a claim shows that the cause of action has not been brought within the statute of limitations.” Robinson v. Johnson, 313 F.3d 128, 135 (3d Cir. 2002)
(quoting Hannah v. U.S. Veterans’ Admin. Hosp., 514 F.2d 1092, 1094 (3d Cir. 1975)); see Oshiver v. Levin, Fishbein, Sedran & Berman, 38 F.3d 1380, 1384 n.1 (3d Cir. 1994). This deficiency must be apparent on the face of the pleading. See Schmidt v. Skolas, 770 F.3d 241, 249 (3d Cir. 2014) (citation omitted). Our court of appeals has explained that the meaning of “the face of the complaint,” as it relates to asserting affirmative defenses in a motion to dismiss, is coextensive with the
general Rule 12(b)(6) limitations. Id.; see also Hoffman v. Nordic Nats., Inc., 837 F.3d 272, 280 & n.52 (3d Cir. 2016) (citations omitted) (discussing raising affirmative defense of preclusion in Rule 12(b)(6) motion). Thus, materials properly considered include not only the complaint but also matters of public record, exhibits attached to the complaint, and undisputed materials embraced by the complaint but provided by the defendant. See Schmidt, 770 F.3d at 249; Hoffman,
837 F.3d at 280 & n.52. Here, the survival claims are subject to a two-year statute of limitations. See 42 PA. CONS. STAT. ANN. § 5524(2).5 The discovery rule does not apply to toll the
5 The statute provides in pertinent part that “[a]n action to recover damages for injuries to the person or for the death of an individual caused by the wrongful act or neglect or unlawful violence or negligence of another” must be “commenced within two years.” 42 PA. CONS. STAT. ANN. § 5524(2). statute on survival actions; the clock begins to run, “at the latest,” upon the decedent’s death. Pastierik v. Duquesne Light Co., 526 A.2d 323, 326 (Pa. 1987) (quotation omitted). Mrs. Doe passed away March 29, 2021, (see Doc. 1-1 ¶ 122), and
the complaint in this matter was initially filed nearly a year after the statute ran, on March 8, 2024, (see Doc. 1-1 at 2-3). Therefore, the claims are untimely on the face of the complaint unless an exception applies. Doe argues that the doctrine of fraudulent concealment operates to toll the statute of limitations under the circumstances alleged. (See Doc. 20 at 7-8 (citing Krapf v. St. Luke’s Hosp., 4 A.3d 642, 649-50 (Pa. Super. Ct. 2010) (finding that disputes of material fact existed regarding application of doctrine of fraudulent
concealment to survival action), appeal denied, 34 A.3d 831 (Pa. 2011) (Table))). To plead fraudulent concealment, a plaintiff must set forth facts plausibly demonstrating that: (1) the defendant took steps to “actively mislead” the plaintiff, (2) the defendant’s efforts prevented the plaintiff from recognizing the accrual of their claim within the limitations period, and (3) the plaintiff exercised reasonable diligence to uncover the relevant facts. Cetel v. Kirwan Fin. Grp., Inc., 460 F.3d 494,
509 (3d Cir. 2006) (citing Mathews v. Kidder, Peabody & Co., 260 F.3d 239, 256 (3d Cir. 2001)). In addition, a plaintiff claiming fraudulent concealment in federal court must meet the heightened pleading standard of Rule 9(b); that is, they must state their allegations of fraud or mistake “with particularity.” See Blanyar v. Genova Prods., Inc., No. 3:15-CV-1303, 2016 WL 740941, at *5 (M.D. Pa. Feb. 25, 2016) (citing FED. R. CIV. P. 9(b); Kontonotas v. Hygrosol Pharm. Corp., 424 F. App’x 184, 187 (3d Cir. 2011) (nonprecedential)), aff’d, 861 F.3d 426 (3d Cir. 2017). Allegations that a defendant “intentionally hid” unlawful activity are insufficient. Arndt v. Johnson & Johnson, 67 F. Supp. 3d 673, 680 (E.D. Pa. 2014). And “[m]ere non-disclosure is
not a misleading act for purposes of tolling the statute of limitations,” see Blanyar, 2016 WL 740941, at *6 (citation omitted); a plaintiff must instead plead “an independent act of concealment,” see Cunningham v. M&T Bank Corp., No. 1:12- CV-1238, 2015 WL 539761, at *4 (M.D. Pa. Feb. 10, 2015) (quotation and citations omitted). Doe has not met this substantial burden. His complaint only hints at affirmative acts of deception, namely, promises in defendants’ notice of privacy
practices and terms of use policy. (See Doc. 1-1 Exs. B & C). These documents, however, are themselves insufficient to meet the particularity standard of Rule 9(b) because the complaint does not explain why those initial promises resulted in the complaint being filed almost three years after Mrs. Doe’s death. The complaint does not refer to any facts related to ongoing concealment to support the threadbare conclusions that “[t]he applicable statutes of limitations have been
tolled as a result of [defendants’] knowing and active concealment.” (See Doc. 1-1 ¶ 177).6 The claims of Mrs. Doe’s estate are dismissed without prejudice.7
6 This language can be found in a section of the complaint entitled “tolling, concealment, and estoppel,” which also includes boilerplate, conclusory statements that the applicable statutes have “been tolled by operation of the discovery rule and the doctrine of continuing tort.” (See Doc. 1-1 ¶ 180). 7 Courts should provide leave to amend “when justice so requires,” and may deny that relief only where the moving party has demonstrated undue delay, bad faith, or dilatory motives, and where the amendment would be futile or prejudicial. B. Doe States a Wiretapping and Electronic Surveillance Claim Under Pennsylvania Law. Defendants next posit that Doe’s WESCA claim should be dismissed for two reasons: first, because Doe accessed the relevant webpages from Ohio, not Pennsylvania; and second, because the complaint does not allege the acquisition of content as defined by caselaw interpreting the statute. (See Doc. 13 at 7-12). Pennsylvania’s WESCA provides “‘[a]ny person whose wire, electronic or oral communication is intercepted, disclosed or used’” in violation of the statute a private right of action against “any person who intercepts, discloses or uses” those
communications. Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 125 (3d Cir. 2022) (quoting 18 PA. CONS. STAT. ANN. § 5725(a)). Though WESCA provides broader remedies than the federal Wiretap Act, it is not limitless. “Pennsylvania courts have declined to extend the WESCA to cover conduct occurring wholly outside the Commonwealth—at least in the context of recording telephone conversations.” See id. at 130 (explaining that courts have interpreted WESCA’s “acquisition”
requirement to mean that only those intercepts that occur in part within the Commonwealth are covered by the Act, though the statute does not provide guidance regarding where an acquisition occurs) (citing Larrison v. Larrison, 750 A.2d 895, 898 (Pa. Super. Ct. 2000)).
See Lake v. Arnold, 232 F.3d 360, 373 (3d Cir. 2000) (citing FED. R. CIV. P. 15(a); Forman v. Davis, 371 U.S. 179, 178 (1962)). Here, leave to amend is appropriate because the deficiencies identified with the complaint may be cured by proper factual allegations in an amendment. Our court of appeals has noted that the location of a particular acquisition or intercept is a question of fact involving several considerations. See id. at 130-31 & n.7 (citation omitted) (so holding on a Rule 56 motion; noting that electronic
communications are typically acquired when software reroutes communications to an intercept, while simultaneously emphasizing that an acquisition may occur at more than one location). Here, Doe includes sufficient factual material to support the plausible inference that the intercept happened in Pennsylvania, where defendants maintain their respective principal places of business, and not Ohio, where he accessed the webpage. (See Doc. 1-1 ¶¶ 30-31). Defendants acquisition-of-content-based arguments, (see Doc. 13 at 8-12),
fare no better. WESCA only proscribes acquisition or transmission of “‘the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.’” See Popa, 52 F.4th at 126 (quoting 18 PA. CONS. STAT. ANN. § 5702). When assessing claims under wiretapping statutes, many courts distinguish between the “contents of” a communication—i.e., the “intended message conveyed by the communication”—and metadata (sometimes called
“record information” or “routing information”), which describe the characteristics of the message. See In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 137 (3d Cir. 2015) (noting this distinction while assessing the federal Wiretap Act); In re Zynga Priv. Litig., 750 F.3d 1098, 1104, 1107 (9th Cir. 2014) (assessing requirements of the Stored Communications Act, which incorporates the federal Wiretap Act’s definition of “contents”—“any information concerning the substance, purport, or meaning of [a] communication,” see 18 U.S.C. §§ 2510(8), 2711(1); noting that URL is not content even when it discloses that person viewed page of gay support group); In re Facebook Internet Tracking Litig., 140 F. Supp. 3d 922, 925 (N.D. Cal 2015).
Our court of appeals has cautioned, however, that “the line between contents and metadata is not abstract but contextual with respect to each communication” and it has accordingly classified the “‘content’ inquiry” as “‘inherently relative’” and a “case-specific one turning on the role [certain identifiers, including location] played in the ‘intercepted’ communication.” See In re Google, 806 F.3d at 136-37 (quotations omitted) (holding that failure to state whether URLs Google allegedly transmitted “played a routing function” as non-content or were substance of
communications at issue was not fatal to federal Wiretap Act claim). This standard recognizes that the categories of content and non-content overlap and are not mutually exclusive. See id. at 137-39. Under it, the acquisition of “at least some ‘content’” may be properly inferred from a complaint that includes facts plausibly demonstrating “a broad scheme in which the defendants generally acquired and tracked the plaintiffs’ internet usage.” See id. at 139. Doe’s is one such complaint,
and his WESCA claim should not be dismissed on the basis that he fails to plead acquisition of content at this early procedural juncture. C. Doe’s Unfair Trade Practices and Consumer Protection Claims Must be Dismissed. Defendants next argue that Doe fails to state a claim under Pennsylvania’s UTPCPL, 73 PA. CONS. STAT. ANN. § 201 et seq., because the complaint purportedly fails to plead the elements of justifiable reliance and damages. (See Doc. 13 at 24- 26). To succeed on a UTPCPL claim, a plaintiff must demonstrate that justifiable reliance on the defendant’s actions caused damages. Hunt v. U.S. Tobacco Co., 538 F.3d 217, 224 (3d Cir. 2008) (quoting Yocca v. Pittsburgh Steelers Sports, Inc.,
854 A.2d 425, 438 (Pa. 2004)). The justifiable reliance inquiry involves consideration of several factors, including the relationship between the parties, the nature of the transactions that occurred between them, and whether the plaintiff knew or should have known that the inducements they were offered were false. See Corsale v. Sperian Energy Corp., 412 F. Supp. 3d 556, 566 (W.D. Pa. 2019) (citations omitted). This element “is typically a question of fact for the fact-finder to decide,” see Toy v. Metro. Life Ins. Co., 928 A.2d 186, 208 (Pa. 2007) (citation omitted), though
a court may determine justifiable reliance as a matter of law even at the motion to dismiss stage, see Hunt, 538 F.3d at 227-28 (affirming dismissal of case for failure to plead facts demonstrating justifiable reliance; remanding for consideration of whether curative amendment was possible). Here, Doe’s allegations that defendants promised to keep his information private in their notice of privacy practices and terms of use are conclusory. (See
Doc. 1-1, Exs. B & C). Judges in our district previously have found almost identical allegations insufficient when assessing a claim that a defendant retailer wrongfully disseminated consumers’ payment information. See In re Rutter’s Inc. Data Sec. Breach Litig., 511 F. Supp. 3d 514, 542 (M.D. Pa. 2021) (Jones, C.J.) (citing Weinberg v. Sun Co., 777 A.2d 442, 446 (Pa. 2001)); see also Weinberg, 777 A.2d at 446 (explaining that in UTPCPL actions by private plaintiffs, allegations that advertisements might influence purchasing decisions were insufficient to demonstrate that justifiable reliance caused harm). Doe has not explicitly plead that he read or understood the privacy policy before he began using defendants’ webpages and has instead simply attached those documents to his complaint. This
approach is insufficient to plead justifiable reliance. Doe’s consumer protection claim is independently deficient in another respect: it does not contain facts demonstrating “any ascertainable loss of money or property.” 73 PA. CONS. STAT. ANN. § 201-9.2; Weinberg, 777 A.2d at 446. Pennsylvania’s statute requires actual, non-speculative harm, which “must be established from the factual circumstances surrounding each case.” Kaymark v. Bank of Am., N.A., 783 F.3d 168, 180 (3d Cir. 2015) (quotation and citations
omitted) (propounding that rule in the absence of Pennsylvania Supreme Court authority directly on point), abrogated in part on other grounds by Obduskey v. McCarthy & Holthus LLP, 586 U.S. 466 (2019). Threadbare allegations of lost time or emotional distress will not suffice; facts from which an ascertainable loss of money or property can be plausibly inferred are required. In re Rutter’s, 511 F. Supp. 3d at 541 (dismissing claims based on allegations of time lost to remedial
measures while sustaining claims substantiated by facts supporting finding of lost wages in pursuit of remediation). And “[s]hame, embarrassment, and emotional distress are . . . not cognizable under the UTPCPL.” Walkup v. Santander Bank, N.A., 147 F. Supp. 3d 349, 358 (E.D. Pa. 2015); see also Riviello v. Chase Bank USA, N.A., No. 3:19-CV-510, 2020 WL 1129956, at *4 (M.D. Pa. Mar. 4, 2020) (same). Doe’s complaint sets forth only conclusory allegations of damages, including monetary damages; loss of privacy; unauthorized disclosure of private information; use of private information for advertising purposes; embarrassment, humiliation, frustration, and emotional distress; decreased value of personal information; loss of the benefit of the bargain; and increased risk of future harm resulting from further
unauthorized use and disclosure of his information. (See Doc. 1-1 ¶¶ 131, 204, 211, 222, 232, 239, 245). The complaint contains no facts to support those conclusions or any other “ascertainable loss.” See 73 PA. CONS. STAT. ANN. § 201-9.2. Doe’s UTPCPL claim is dismissed without prejudice. D. Doe’s Negligence Claim Must be Dismissed. A plaintiff advancing a negligence claim under Pennsylvania law must allege facts plausibly demonstrating: (1) the existence of “a duty to conform to a certain
standard for the protection of others against unreasonable risks”; (2) that the defendant “fail[ed] to conform to that standard”; (3) a causal connection between the conduct and the resulting injury to the plaintiff; and (4) “actual loss or damage to the plaintiff.” Brewington ex rel. Brewington v. City of Philadelphia, 199 A.3d 348, 355 (Pa. 2018). The complaint here is deficient in several respects. For one, it omits specific
factual allegations regarding the “identity of any intended recipient or the content, timing, or number of the alleged communications,”—information that speaks to the causal connection required to maintain a claim at this procedural juncture. See Murphy v. Thomas Jefferson Univ. Hosps., Inc., No. 22-CV-4674, 2023 WL 7017734, at *5 (E.D. Pa. Oct. 10, 2023) (quotation omitted) (dismissing claim of negligence in healthcare data breach case); see also Smart v. Main Line Health, No. 22-CV-5239, 2024 WL 2943760, at *4 (E.D. Pa. June 10, 2024) (same); Santoro v. Tower Health, No. 22-CV-4580, 2024 WL 1773371, at *5-6 (E.D. Pa. Apr. 24, 2024) (citation omitted) (same, and noting further that specific allegations regarding “consequences” of information being disclosed are critical to sustaining complaint of negligence under
Pennsylvania law). Moreover, Doe has not adequately pleaded facts regarding damages. His allegations of shame, embarrassment, and emotional distress are not supported by any facts detailing the contents of the information transmitted or why its disclosure would lead to psychological and emotional turmoil. See Murphy, 2023 WL 7017734, at *5 (dismissing complaint in part because court could not consider assertions of emotional distress without supporting factual allegations) (citing Rosenberg v. C.R.
Bard, Inc., 387 F. Supp. 3d 572, 582 (E.D. Pa. 2019); Lapensohn v. Hudson City Sav. Bank, No. 19-CV-4576, 2021 WL 1581402 (E.D. Pa. Apr. 21, 2021)). Although Doe alleges that he lost time and money seeking remediation, was deprived of “the benefit of the bargain,” and now faces an increased risk of future harm, (see, e.g., Doc. 1-1 ¶ 131), his complaint contains no facts to support those conclusory allegations. Cf. In re Rutter’s, 511 F. Supp. 3d at 541 (dismissing state-law consumer
protection claims in part because plaintiff alleged he lost time and money taking remedial measures but failed to state how much time or what it cost him, in terms of lost wages or otherwise). The closest the complaint comes to adequately pleading damages is the allegation that, due to defendants’ conduct, Doe “now receives targeted health- related advertisements reflecting private medical treatment information, including those related to skin conditions, arthritis, geriatric medical conditions, as well as for clinical trials, and physicians.” (See Doc. 1-1 ¶ 129). In Doe v. Regents of University of California, 672 F. Supp. 3d 813 (N.D. Cal. 2023), the court found averments that the plaintiff received health-related advertisements after a data breach sufficient to
plead injury. See Regents, 672 F. Supp. 3d at 818-19. But the complaint in Regents was significantly more detailed than Doe’s in several relevant respects. The Regents plaintiff stated that she accessed the defendants’ healthcare portal using the email linked to her Meta account, and later received health-related advertisements on Facebook and to her email. See id. at 819. She also alleged facts showing a one-for-one correlation between the information she input into the portal and the topics of the advertisement she received. See id. For instance, she alleged
that she received advertisements for medications to treat high blood pressure after she entered data related to heart and blood pressure issues. See id. at 816. Doe, on the other hand, includes no facts to support the conclusory allegation that the purported disclosure led to his receipt of targeted advertisements. The complaint does not specify when the ads began to appear, and there is not a direct logical correlation between the information Doe entered into defendants’ system,
(see Doc. 1-1 ¶ 123), and the advertisements he later received. Although Doe’s complaint contains generic allegations that the Meta pixel “can link a visitor’s website interactions with an individual’s unique Facebook ID” using cookies, (see id. ¶ 10 & n.21), as well as IP address information, (see id. ¶ 164), it contains no allegations that Doe is a Facebook user or ever accessed Facebook from the same computer he used to access defendants’ website.8 And, as Doe’s complaint explains, Facebook can identify users from the data collected using the pixel only “when Facebook account holders use the Facebook app or website.” (See id. ¶ 67; see also
id. ¶¶ 105, 164). Without facts regarding Doe’s Facebook usage, conclusory allegations that the pixel “likely allowed Facebook to connect users’ identities with the details reported within the [recorded and transmitted] events,” (see id. ¶ 90), are insufficient. That Doe does not allege a temporal connection between his use of defendants’ website and the appearance of the advertisements further weakens the causal inference from the allegations in the complaint. Other courts have dismissed claims based upon similarly amorphous allegations. See, e.g., Nienaber v. Overlake
Hosp. Med. Ctr., 733 F. Supp. 3d 1072, 1083 (W.D. Wash. 2024) (distinguishing Regents and noting that claims regarding specific information that plaintiff submitted online and causal connection with resulting advertisements is within
8 The complaint also states that certain information allegedly collected and transmitted is anonymized or “hashed,” and therefore is associated with a user’s identity only if they have used the same computer to access their Facebook profile at some point in the past. (See Doc. 1-1 ¶¶ 67, 105, 164). This caveat further highlights the importance of factual allegations that Doe accessed his Facebook account using the same computer he used to access defendants’ webpages— allegations without which it is unreasonable to infer the requisite causal connection to sustain his negligence claim. plaintiff’s control and should not require discovery).9 Accordingly, Doe’s negligence claim is dismissed without prejudice. E. Doe Has Not Stated an Invasion of Privacy Claim. Doe advances two distinct invasion-of-privacy claims: intrusion upon seclusion and public disclosure of private facts. The former requires him to plead
“an intentional intrusion upon the seclusion of [his] private concerns which was substantial and highly offensive to a reasonable person,” and that “the information disclosed would have caused mental suffering, shame or humiliation to a person of ordinary sensibilities.” Boring v. Google Inc., 362 F. App’x 273, 278-79 (3d Cir. 2010) (nonprecedential) (quoting Pro Golf Mfg., Inc. v. Trib. Rev. Newspaper Co., 809 A.2d 243, 247 (Pa. 2002)). Because publication is not an element of the claim, courts must examine the harm caused by the intrusion itself. See id. (citing Borse v. Piece
Goods Shop, Inc., 963 F.2d 611, 621 (3d Cir. 1992)). Courts may determine whether the conduct alleged is “highly offensive” as a matter of law where appropriate. See id. (citing Diaz v. D.L. Recov. Corp., 486 F. Supp. 2d 474, 475-80 (E.D. Pa. 2007)). To succeed on the latter claim, Doe must plead facts establishing (1) publicity of (2) private facts, which (3) would be highly offensive to a reasonable person and are
9 Some courts have recognized a property interest in personal data and have accordingly begun to classify the devaluation of personal data following an unauthorized disclosure as a sufficient injury to permit discovery on a claim of negligence. See Opris v. Sincera Reprod. Med., No. 21-CV-3072, 2022 WL 1639417, at *8 (E.D. Pa. May 24, 2022) (collecting cases). However, it is unclear from the face of Doe’s complaint what information was transmitted, and he does not plausibly allege how disclosure of his information in particular resulted in devaluation. Doe has not presented any facts to “nudge” this theory of damages “across the line from conceivable to plausible.” Twombly, 550 U.S. at 570. (4) not of legitimate concern to the public. Harris ex rel. Harris v. Easton Pub. Co., 483 A.2d 1377, 1384 (Pa. Super. Ct. 1984) (citation omitted). Doe’s allegations related to these claims are deficient in at least two respects.
First, there are no specific facts regarding precisely what information was disclosed to whom and why that transmission would cause shame or embarrassment under the circumstances. Nor is there any other detailed factual description of the allegedly highly offensive conduct. Without this information, it is impossible to assess whether the allegations meet the threshold of offensiveness to withstand a motion under Rule 12(b)(6). See Murphy, 2023 WL 7017734, at *7 (footnote and citations omitted) (dismissing privacy claims in healthcare data breach case because
plaintiff did not plead facts to make threshold showing of highly offensive conduct). Second, Doe has not pleaded facts demonstrating that the conduct alleged caused actual damages—a defect that undermined his negligence claim and is once again impactful here. The invasion of privacy claims are dismissed without prejudice. F. Breach of Implied Contract A claim for breach of contract under Pennsylvania law requires “(1) the
existence of a contract, including its essential terms, (2) a breach of a duty imposed by the contract and (3) resultant damages.” CoreStates Bank, N.A. v. Cutillo, 723 A.2d 1053, 1058 (Pa. Super. Ct. 1999). These elements also govern a claim for breach of implied contract, “except the contract is implied through the parties’ conduct, rather than expressly written.” Enslin v. Coco-Cola Co., 136 F. Supp. 3d 654, 675 (E.D. Pa. 2015) (citing Highland Sewer & Water Auth. v. Forest Hills Mun. Auth., 797 A.2d 385, 390 (Pa. Commw. Ct. 2002), appeal denied, 848 A.2d 930 (Pa. 2004) (Table)), aff’d, 739 F. App’x 91 (3d Cir. 2018) (nonprecedential). The factfinder may infer intent from the parties’ ordinary course of dealing; however, “naked assertions devoid of further factual enhancement fail to state an actionable
claim.” Longenecker-Wells v. Benecard Servs. Inc., 658 F. App’x 659, 661 (3d Cir. 2016) (nonprecedential) (quoting Iqbal, 556 U.S. at 678). The breach of implied contract claim must be dismissed. Some courts have allowed these claims to proceed to discovery in circumstances where a defendant promised to maintain the privacy of a plaintiff’s personal information. See Nienaber, 733 F. Supp. 3d at 1091-92 (collecting cases). But that does not change the fact that the complaint contains insufficient factual details to plead causation
and damages. Doe’s breach of implied contract claim is dismissed without prejudice as well. G. Unjust Enrichment Doe’s penultimate claim is one of unjust enrichment. To prevail on this claim, Doe must plead facts plausibly demonstrating that he conferred a benefit to defendants, who appreciated the benefit under such circumstances that equity
requires disgorgement. See Mass. Mut. Life Ins. Co. v. Curley, 459 F. App’x 101, 108 (3d Cir. 2012) (nonprecedential); see also Ne. Fence & Iron Works, Inc. v. Murphy Quigley Co., 933 A.2d 664, 668-69 (Pa. Super. Ct. 2007) (quoting Lackner v. Glosser, 892 A.2d 21, 24 (Pa. Super. Ct. 2006)), appeal denied, 947 A.2d 737 (Pa. 2008) (Table). The same deficiencies previously identified—including the lack of specificity regarding what information was disclosed to whom under what circumstances, and whether that information was linked to Doe specifically—also impact Doe’s unjust enrichment claim. He cannot, without those specific facts, demonstrate that defendants obtained a benefit from the conduct alleged or that justice requires disgorgement. See Nienaber, 733 F. Supp. 3d at 1093-94 (dismissing unjust
enrichment claim in healthcare data breach case for failure to plead specific facts regarding what material benefit plaintiff conferred to defendant). For those reasons, Doe’s unjust enrichment claim is dismissed with leave to amend. H. Breach of Fiduciary Duty Lastly, Doe alleges defendants breached their fiduciary duty to him. The elements of a claim of breach of fiduciary duty are “(1) that the defendant negligently or intentionally failed to act in good faith and solely for the benefit of
plaintiff in all matters for which he or she was employed; (2) that the plaintiff suffered injury; and (3) that the agent’s failure to act solely for the plaintiff’s benefit . . . was a real factor in bring[ing] about plaintiff’s injuries.” McDermott v. Party City Corp., 11 F. Supp. 2d 612, 626 n.18 (E.D. Pa. 1998) (alteration in original) (quoting Pa. S.S.J.I. § 4.16 (1991)), cited approvingly by Nayak v. C.G.A. L. Firm, 620 F. App’x 90, 94 (3d Cir. 2015) (nonprecedential), cert. denied, 577 U.S. 1224
(2016) (mem.). As discussed previously at length, Doe has not pleaded the requisite facts to support a plausible causal relationship between defendants’ conduct and damages. This count is accordingly dismissed with leave to amend. IV. Conclusion Defendants’ motion to dismiss is granted in part and denied in part. An appropriate order shall issue.
/S/ KELI M. NEARY Keli M. Neary United States District Judge Middle District of Pennsylvania
Dated: February 14, 2025