Cybersecurity Policy Report, S.D. Cal.: California court allows some privacy claims against online pharmacy to proceed, dismisses others, (Feb 20, 2025)
Law Firms Mentioned:Buchanan Ingersoll & Rooney LLP | Swigart Law Group, APC
Organizations Mentioned:Buchanan Ingersoll & Rooney, PC | Hwareh.com, Inc.
A California federal court ruled that HealthWarehouse.com must face certain privacy claims in a class action lawsuit but dismissed others, including a Wiretap Act claim, with leave to amend.
The federal district court in California reviewed a class action lawsuit filed by a customer against HealthWarehouse.com, an online pharmacy. The customer alleged that the company secretly collected her sensitive browsing data without consent, violating federal and state privacy laws. The court previously dismissed her complaint for lack of personal jurisdiction but allowed her to amend. In response to the online pharmacy’s renewed motion to dismiss, the court found that the company had purposefully directed its activities toward California, allowing certain claims to proceed while dismissing others with leave to amend (Zarif v. Hwareh.com, Inc., No. 23-cv-0565-BAS-DEB (S.D. Cal. Feb. 13, 2025)).
Regarding the Wiretap Act claim, the online pharmacy argued that it did not intercept the “contents” of communications, as required under the Wiretap Act. The customer, however, alleged that search terms related to prescription medications were unlawfully intercepted and shared. The court ruled that such data could constitute content under the Wiretap Act but found that the customer did not sufficiently allege that the online pharmacy acted with a criminal or tortious purpose. Consequently, the court dismissed the Wiretap Act claim but granted the customer leave to amend.
The court also examined the costumer’s claim under California’s Computer Data Access and Fraud Act (CDAFA), which prohibits unauthorized access and use of computer data. The customer alleged that the online pharmacy deployed tracking tools that accessed and transmitted her data without permission. While the court found that the customer plausibly alleged unauthorized access, she failed to show damages or unjust enrichment, leading to the claim’s dismissal with leave to amend.
Additionally, the court dismissed the customer’s claims under the California Confidentiality of Medical Information Act (CMIA) and the California Consumer Privacy Act (CCPA) due to insufficient allegations but allowed the customer to amend them. However, the court denied the motion to dismiss her claim under California’s Invasion of Privacy Act. The customer has until March 5, 2025, to file an amended complaint.
The case is No. 23-cv-0565-BAS-DEB.
Judge: Bashant, C.
Attorneys: Joshua Brandon Swigart (Swigart Law Group, APC) for Shahnaz Zarif. Jennifer Oliver (Buchanan Ingersoll & Rooney LLP) for Hwareh.com, Inc.
Companies: Hwareh.com, Inc.
Cases: CaseDecisions CyberPrivacyFeed EHRNews HIPAANews DataPrivacy DataSecurity LitigationEnforcement CaliforniaNews