Privacy & Publicity/ Negligence/Equitable Remedies

The U.S. Court of Appeals for the Fourth Circuit has affirmed dismissal by a federal district court in South Carolina of customers' invasion of privacy and related claims against Walgreens for sharing the customers' personal identifying information (PII) among its internal customers and entities through its information database system. "35 Though PIPA subjects its violators to criminal penalties, it does not explicitly authorize a private right of action, and the district court, while finding an implicit private right of action in PIPA, construed this private right to be limited to external data transfers, and not to the transfers within the Walgreens organization as alleged by the customers.36 PIPA does not define what it means to "transfer," "receive," or "disclos[e]" PII, as set out in the statute, and South Carolina does not have any case law interpreting PIPA, the appeals court noted. The customers' claims of negligence per se under HIPAA was rejected by the appeals court because the circuit had only five months previously followed the lead of other circuits in ruling that HIPAA was not intended to create a private right of action.40 Unjust Enrichment The customers claimed that they reasonably expected payment from Walgreen's use of their PII, and that Walgreens would be unjustly enriched by not paying it to them.