Appeals Court Drops CIPA Case Against Quest Diagnostics, Citing Poor Evidence
An appeals court rejected a California Invasion of Privacy Act (CIPA) suit against Quest Diagnostics. In a ruling posted Thursday, the 3rd U.S. Circuit Court of Appeals said that a claim could not be brought because “none of [the allegedly shared] data was substantive medical information."
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The original July 2022 complaint at the U.S. District Court for Eastern California (case 2:23-cv-20647), accused the diagnostic information services provider of sharing personally identifiable information (PII) with Facebook via a tracking pixel, despite “expressly warrant[ing] that it will never conspire with a third-party to intercept usage data paired with” PII.
In addition, the plaintiffs in the class action said that communications with protected medical information was part of the PII that Quest collected and transmitted.
The case was later transferred to the U.S. District Court for New Jersey, where Judge William Martini dismissed it, ruling that since the users’ browsers communicated directly with the web page visited, Quest didn't acquire the information from the transmissions. The plaintiffs appealed.
The 3rd Circuit affirmed the district court decision. The CIPA claim "lacks merit,” as “there was no eavesdropping,” wrote Judge Patty Schwartz. Judges Tamika Montgomery-Reeves and Paul Matey joined the opinion.
“Although the nature of treatment is medical information, the fact that treatment occurred is not,” Schwartz said. Since the plaintiffs didn’t allege Quest disclosed test results or substantive medical information, and “at most” the company disclosed they had been patients, that's not medical information protected under law.