Rand v. Eyemart Express LLC

• Court: District Court, N.D. Texas
• Decided: October 1, 2024
• Docket: 3:24-cv-00621
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF TEXAS DALLAS DIVISION

RACHELLE RAND, ET AL., § § § Plaintiffs, § § v. § Civil Action No. 3:24-CV-000621-N § EYEMART EXPRESS, LLC, § § Defendant. §

MEMORANDUM OPINION & ORDER

This Order addresses Defendant Eyemart Express, LLC’s (“Eyemart”) motion to dismiss [14]. Because Plaintiffs Rachelle Rand, Esperanza Gottschau, and Ramon Soto have failed to plead facts sufficient to state a claim for violation of the Federal Electronic Communications Privacy Act (“ECPA”), the Missouri Wiretap Act, or the Illinois Eavesdropping Statute (“IES”), breach of contract, or intrusion of seclusion, the Court grants the motion as to those claims. However, the Court determines Plaintiffs have standing and denies the motion with respect to that argument. Additionally, the Court grants Plaintiffs leave to amend their complaint. I. ORIGINS OF THE MOTION Plaintiffs are three Meta (Facebook) users who accessed the Eyemart website to search for prescription eyewear products and to search for eye doctors in their areas. Pls.’ Compl. ¶¶ 25–27 [1]. Eyemart operates a website where customers may browse eyewear and search for doctors in their area. Id. ¶ 28. The eyewear is available to purchase in person at an Eyemart store. Id. ¶ 1. The eye doctor search function allows users to search for eye doctors near them. Pl. Resp. 3–4 [24]. It provides a list of local providers with links to doctors’ webpages and their phone numbers to call to schedule with the doctors

directly. Id. Eyemart’s website utilizes Meta Pixel technology, which tracks user interactions on the website and shares the data with Meta. Pls.’ Compl. ¶¶ 16, 75. Meta users agree to a Meta Privacy and Cookie Policy that stores a user identification cookie on their devices. Id. ¶¶ 90–92. This cookie attaches to metadata when Pixel events are triggered on Pixel-

installed webpages. Id. ¶¶ 93–96. When data is collected by Meta from a website in which Pixel technology is utilized, all tracked events specific to that user are accompanied by the user identification cookie. Id. ¶ 108. This user identification cookie can be used by Meta to de-anonymize information related to the user. Id. ¶ 109. Plaintiff Rachelle Rand visited the website “to locate an eye doctor” and “search for

products.” Id. ¶ 25. Plaintiff Esperanza Gottschau accessed the website to “search for prescription eyewear products” and “browsed the Website’s selection of prescription products.” Id. ¶ 26. Plaintiff Ramon Soto visited the website “to search for prescription eyewear products.” Id. ¶ 27. Because all three had Facebook accounts and had previously consented to Meta storing a user identification cookie on their devices, their actions on the

website, when collected by Meta, are capable of being de-anonymized. Id. ¶¶ 25–27, 90– 92. Plaintiffs brought this suit on behalf of themselves and all others similarly situated. Plaintiffs assert violations of the ECPA, the Missouri Wiretap Act, the Illinois Eavesdropping Statute, breach of contract, and intrusion upon seclusion. Eyemart now moves to dismiss Plaintiffs’ Class Action Complaint for lack of standing and for failure to state a claim.

II. RULE 12(B)(1) STANDARD Under the United States Constitution, a federal court may decide only actual “cases” or “controversies.” U.S. CONST. art. III, § 2. A court properly dismisses a case where it lacks the constitutional power to decide it. Home Builders Ass’n of Miss., Inc. v. City of Madison, 143 F.3d 1006, 1010 (5th Cir. 1998). “The justiciability doctrines of standing,

mootness, political question, and ripeness all originate in Article III’s ‘case’ or ‘controversy’ language.” Choice Inc. of Tex. v. Greenstein, 691 F.3d 710, 715 (5th Cir. 2012) (quoting Daimler Chrysler Corp. v. Cuno, 547 U.S. 332, 352 (2006)) (internal quotation marks omitted). “Standing and ripeness are required elements of subject matter jurisdiction and are therefore properly challenged on a Federal Rule of Civil Procedure

12(b)(1) motion to dismiss.” Roman Catholic Diocese of Dallas v. Sebelius, 927 F.Supp.2d 406, 415–16 (N.D. Tex. 2013) (citing Xerox Corp. v. Genmoora Corp., 888 F.2d 345, 350 (5th Cir. 1989) and Western Geco L.L.C. v. Ion Geophysical Corp., 776 F.Supp.2d 342, 350 (S.D. Tex. 2011)). The standing requirement has three elements: (1) injury in fact, (2) causation, and

(3) redressability. See Bennett v. Spear, 520 U.S. 154, 167 (1997). The injury cannot be merely “conjectural or hypothetical.” Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009). Causation requires that the injury “fairly can be traced to the challenged action of the defendant” rather than to “the independent action of some third party not before the court.” Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 41–42 (1976). And redressability requires that it is likely, “as opposed to merely ‘speculative,’ that the injury will be ‘redressed by a favorable decision.’” Lujan v. Defs. Of Wildlife, 504 U.S. 555, 561

(1992) (quoting Simon, 426 U.S. at 38, 43). “‘[W]hen standing is challenged on the basis of the pleadings,’ [courts] must ‘accept as true all material allegations of the complaint and . . . construe the complaint in favor of the complaining party.’” Ass’n of Am. Physicians & Surgeons, Inc. v. Tex. Med. Bd., 627 F.3d 547, 550 (5th Cir. 2010) (quoting Pennell v. City of San Jose, 485 U.S. 1, 7 (1988)) (first alteration and omission in original).

III. RULE 12(B)(6) STANDARD When deciding a Rule 12(b)(6) motion to dismiss, a court must determine whether the plaintiff has asserted a legally sufficient claim for relief. Blackburn v. City of Marshall, 42 F.3d 925, 931 (5th Cir. 1995). A viable complaint must include “enough facts to state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S.

544, 570 (2007). To meet this “facial plausibility” standard, a plaintiff must “plead[] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A court generally accepts well-pleaded facts as true and construes the complaint in the light most favorable to the plaintiff. Gines v. D.R. Horton, Inc., 699 F.3d 812, 816 (5th Cir. 2012).

But a plaintiff must provide “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 (internal citations omitted). “Factual allegations must be enough to raise a right to relief above the speculative level . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Id. (internal citations omitted). In ruling on a Rule 12(b)(6) motion, a court generally limits its review to the face

of the pleadings, accepting as true all well-pleaded facts and viewing them in the light most favorable to the plaintiff. See Spivey v. Robertson, 197 F.3d 772, 774 (5th Cir. 1999). However, a court may also consider documents outside of the pleadings if they fall within certain limited categories. First, “[a] court is permitted . . . to rely on ‘documents incorporated into the complaint by reference, and matters of which a court may take judicial

notice.’” Dorsey v. Portfolio Equities, Inc., 540 F.3d 333, 338 (5th Cir. 2008) (quoting Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322 (2007)). Second, “[a] written document that is attached to a complaint as an exhibit is considered part of the complaint and may be considered in a 12(b)(6) dismissal proceeding.” Ferrer v. Chevron Corp., 484 F.3d 776, 780 (5th Cir. 2007). Third, a “court may consider documents attached

to a motion to dismiss that ‘are referred to in the plaintiff’s complaint and are central to the plaintiff’s claim.’” Sullivan v. Leor Energy, LLC, 600 F.3d 542, 546 (5th Cir. 2010) (quoting Scanlan v. Tex. A&M Univ., 343 F.3d 533, 536 (5th Cir. 2003)). Finally, “[i]n deciding a 12(b)(6) motion to dismiss, a court may permissibly refer to matters of public record.” Cinel v. Connick, 15 F.3d 1338, 1343 n.6 (5th Cir. 1994) (citation omitted); see

also, e.g., Funk, 631 F.3d at 783 (stating, in upholding district court’s dismissal pursuant to Rule 12(b)(6), that “[t]he district court took appropriate judicial notice of publicly-available documents and transcripts produced by the [Food and Drug Administration], which were matters of public record directly relevant to the issue at hand”).

IV. THE COURT FINDS STANDING BUT GRANTS THE MOTION TO DISMISS FOR FAILURE TO STATE A CLAIM The Court finds that Plaintiffs have standing to assert their claims. However, the Court finds that Plaintiffs have not pled factual allegations that plausibly show any personal health information was collected or disclosed. Therefore, the Court grants the motion to dismiss for failure to state a claim. Plaintiffs Have Standing Under Rule 12(b)(1) Eyemart argues that Plaintiffs do not have standing because they have failed to plead a cognizable injury in fact. Def.’s Mot. Dismiss 9. Plaintiffs here allege injury through

the alleged disclosure of their private health information. “In determining whether an intangible harm constitutes an injury in fact, both history and the judgment of Congress play important roles.” Spokeo v. Robins, 578 U.S. 330, 340 (2016). Under the Health Insurance Portability and Accountability Act (“HIPAA”), it is clear that disclosure of individually identifiable health information

(“IIHI”) without permission is a cognizable harm. 45 CFR § 164.512(e). Plaintiffs allege “‘an invasion of a legally protected interest’ that is ‘concrete and particularized.’” Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560). The Supreme Court has found that an injury is particularized where it “affect[s] the plaintiff in a personal and individual way.” Id. Here, the harm is particularized because it affects each plaintiff’s

privacy. Likewise, a disclosure of IIHI is sufficient to establish a concrete harm. Therefore, taking all pleadings in the light most favorable to the Plaintiffs, the Court finds that Plaintiffs have standing in this case. Plaintiffs Have Failed to State a Claim Under Rule 12(b)(6)

Federal Electronic Communications Privacy Act and Missouri Wiretap Act.— The Federal Electronic Communications Privacy Act (“ECPA”) is a one-party consent statute. 18 U.S.C.A. § 2511(f) (“It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such a person is a party to the communication or where one of the parties to the

communication has given prior consent.”) In other words, Eyemart cannot eavesdrop on communications directed at it “unless such communication is intercepted for the purpose of committing any criminal or tortious act.” Id. Plaintiffs argue that the crime-tort exception applies here, because to the extent that any communication contained IIHI, the interception was a violation of HIPAA.

Plaintiff Rand has brought a claim under the Missouri wiretap statute individually and on behalf of all others similarly situated. Pls.’ Compl. ¶ 214. The Missouri wiretap statute is modeled off the ECPA, and similarly is a one-party consent statute with a crime- tort exception. MO. REV. STAT. § 542.402.2(3); State v. King, 873 S.W.2d 905, 908 (Mo. Ct. App. 1994). Therefore, the same analysis is applicable to both the ECPA and the Missouri statute here.

Plaintiffs’ threshold argument that the interception was a violation of HIPAA fails because they have not shown that any IIHI was present in the communications at issue here. Plaintiffs have not sufficiently alleged that they entered any personal health information into the website. Nor do they allege how they website is set up to enter prescription information or similar personal health information. Plaintiffs assert that the queries within the search bar are inherently private. Pl. Compl. ¶ 58. However, the example

Plaintiffs use show a query for a brand name. Id. ¶ 99. Because prescription lenses and prescription-specific information is only available in store, it is unclear what private health information would naturally be input into the search bar here. At most, Plaintiffs have alleged that they visited the site to look at glasses they could then go into the store to order, and that they intended to search for the contact information for eye doctors in their location

while on the website. None of these subjective motives is sufficient to constitute individually identifiable health information under HIPAA. Courts have found that HIPAA does not extend to liability for entities to guard against “visitors’ subjective motive for visiting the page.” Am. Hosp. Ass’n v. Becerra, 2024 WL 3075865 at *12 (N.D. Tex. 2024). Even if “most people visit [the website]

for . . . reasons” related to their own healthcare, “without knowing a particular query relates to a category of information in Section 1320d(6), metadata from [an unauthenticated public webpage] search cannot constitute IIHI.” Id. at *12–13. “Simply put, Identity (Person A) + Query (Condition B) ≠ IIHI (Person A has Condition B).” Id. at *14. Following that formula, the fact that Pixel shared with Meta that Plaintiffs looked at glasses

on a site that offers both prescription lenses and nonprescription lenses on their products does not share any of their IIHI. Similarly, the data allegedly shared with Meta that Plaintiffs searched for local eye doctors and may have followed the links provided to the doctor’s websites, which is a step further than Plaintiffs have pled, does not establish “when and where eye exams were scheduled” or “patient status” as Plaintiffs have claimed. Pls.’ Resp. 19–20. This is, however, relatively new case law, and Courts have been somewhat divided

with similar questions. A California court recently found that a plaintiff “filter[ing] the results of [a] physician directory by, among other things, specialty . . . just narrowly survives dismissal by demonstrating that her interactions plausibly relate to the provisions of healthcare.” Cousins v. Sharp Healthcare, 702 F.Supp.3d 967, 973 (S.D. Cal. 2023). There, however, the plaintiff took affirmative steps to search for a particular type of doctor.

While the search function on Eyemart returns only doctors of a single specialty, Plaintiffs are not inputting any private health information, like searching for particular symptoms or medical specialties. The mere standard filtering based on the type of website the Plainiffs visited is not convincing enough here to demonstrate that any private health information was shared.

Plaintiffs have failed to plead facts that plausibly establish that they shared any private health information with Eyemart that could be shared with Meta. Plaintiffs have alleged that they were customers of Eyemart and that they used the website. Without more, their browsing of a retail website is insufficient to show that any private health information was disclosed. Illinois Eavesdropping Act.—Plaintiff Soto has brought a claim under the Illinois Eavesdropping Act (“IEA”) individually and on behalf of all others similarly situated. Pls.’ Compl. ¶ 225. The IEA requires that the communication be “in a

surreptitious manner” and without “the consent of all other parties to the private conversation.” 720 ILL. COMP. STAT. 5/14-2. Plaintiffs have failed to plead that any information was transferred “surreptitiously” here. Both Eyemart and Meta’s privacy policies disclose the possible tracking of user interactions on the website. The only claim here arises out of the type of communication Plaintiffs allege is being tracked. Pl. Compl.

¶ 235 (Plaintiffs “reasonably expected the communication to be private under HIPAA, Eyemart’s express promises of confidentiality [of personal health information], the physician-patient relationship, and other State and federal laws.”) Because Plaintiffs have failed to show that any IIHI was collected or transmitted, their IEA claim fails.

Breach of Contract and Intrusion Upon Seclusion Claims.—Plaintiffs also claim breach of contract and intrusion upon seclusion. Plaintiffs allege that Eyemart breached the contract of Eyemart’s Privacy Statement, which says it will not disclose IIHI without consent. The intrusion upon seclusion claim is based on the idea that sharing Plaintiffs’ IIHI would be a violation of Plaintiffs’ reasonable expectation of privacy. Both of these claims center upon the idea that Eyemart transmitted IIHI to Meta through the

Pixel technology. Because this Court has found that Plaintiffs have failed to sufficiently allege that the information collected contained IIHI, there is insufficient factual basis to state a claim for breach of contract or intrusion upon seclusion. CONCLUSION

Because Plaintiffs have not alleged facts sufficient to state a claim for violation of the ECPA or the Missouri and Illinois wiretapping statutes, breach of contract, and intrusion upon seclusion, the Court grants Eyemart’s motion to dismiss. The Court denies the motion to dismiss as to Eyemart’s standing argument. The Court grants Plaintiffs leave to amend their complaint within thirty (30) days of the date of this order. If Plaintiffs do not so amend, the Court will dismiss all claims with prejudice without further notice.

Signed October 1, 2024. SA C. Godbey □□ Chief United States District Judg

MEMORANDUM OPINION AND ORDER — PAGE 11