In re Pharmatrak, Inc. Privacy Litigation

MEMORANDUM TAURO, District Judge. Plaintiffs, in a consolidated class action, sued Pharmatrak, Inc. and numerous pharmaceutical companies (“Defendants”), alleging that they secretly intercepted and accessed Plaintiffs’ personal information through the use of computer “cookies” and other devices, in violation of state and federal law.1 This court granted summary judgment in favor of Defendants on all counts.2 Plaintiffs’ sole claim on appeal was that Pharmatrak, Inc. (“Pharmatrak”) violated Title I of the Electronic Communications Privacy Act3 (“EPCA”). The Court of Appeals remanded,4 finding that Pharmatrak “intercepted” personal information within the meaning of the EPCA,5 but that the intent element of the statute had -not been adequately addressed by the Parties.6 Defendants’ motion for summary judgment on the EPCA claim is now before the court. DISCUSSION Under Federal Rule of Civil Procedure 56, summary judgment is appropriate “if the pleadings, depositions, answers to in-, terrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law.”7 Rule 56 mandates summary judgment “after adequate time for discovery and upon motion, against a party who fails to make a showing sufficient to establish the existence of an element essential to that party’s case, and on which that party will bear the burden of proof at trial.”8 [266] The “party seeking summary judgment [must] make a preliminary showing that no genuine issue of material fact exists. Once the movant has made this showing, the nonmovant must contradict the showing by pointing to specific facts demonstrating that there is, instead, a trialworthy issue.” 9 The party opposing summary judgment must produce specific evidence of a material factual dispute. The First Circuit has noted that “[a] genuine issue of material fact does not spring into being simply because a litigant claims that one exists. Neither wishful thinking nor ‘mere promise[s] to produce admissible evidence at trial’ ... nor conclusory responses unsupported by evidence ... will serve to defeat a properly focused Rule 56 motion.” 10 In this action, Defendants must make the initial showing that no genuine dispute of material fact exists and that the material facts demonstrate that they did not have the requisite intent under the EPCA. Once Defendants have met this burden, them motion will succeed unless Plaintiffs can point to specific evidence that indicates that Defendants did have the requisite intent. To be criminally or civilly liable under the EPCA, the unlawful interception must have been intentional.11 In its remand opinion, the Court of Appeals set out the legal standard to be applied in deciding the intent issue. The court noted that, in the 1986 amendment of the EPCA, Congress changed the state of mind requirement from “willful” to “intentional,” defining “intentional” in its legislative history.12 As used in the Electronic Communications Privacy Act, the term “intentional” is narrower than the dictionary definition of “intentional.” “Intentional” means more than that one voluntarily engaged in the conduct or caused the result. Such conduct or the causing of the result must have been the person’s conscious objective.13 The court went on to explain that by defining “intentional” in such a narrow manner, “Congress made clear that the purpose of the amendment was to underscore that inadvertent interceptions are not a basis for criminal or civil liability under the EPCA.” 14 Defendants argue that none of the facts indicates any kind of actionable intent on their part, and set forth three principal arguments in support of their summary judgement motion: (1) there was only a small amount of personal data actually found on Pharmatrak’s computer servers; (2) errors from third parties caused the collection of the personal data; and (3) Defendants had no knowledge of the existence of the personal data until after Plaintiffs’ filed their lawsuit. Each of these arguments is addressed seriatim below. A Only a Small Amount of Personal Data Was Actually Found After Plaintiffs’ computer expert conducted a thorough search of Pharmatrak’s computers, as a result of this court’s order to do so, he was able to assemble personal profiles on approximately 232 individuals.15 Pharmatrak’s former Managing Director of Technology calculated that, between October, 1999 and February, 2001, “roughly [267] 18.7 million unique Web users visited the tracked pharmaceutical company pages.” 16 Defendants contend that finding only 233 personal profiles from a potential list of 18.7 million (0.0012%) underscores their assertion that any transfer of personal information was inadvertent. Plaintiffs try to avoid this logical inference by insinuating that Plaintiffs’ expert completed only a partial inspection of Pharmatrak’s computers.17 They wish to imply that a more thorough search of Pharmatrak’s computers might uncover untold numbers of personal profiles. This is mere speculation at best. Pursuant to this court’s order, Plaintiffs’ expert was given unrestricted access to the hard drives of Pharmatrak’s computer servers between December 17, 2001 and January 18, 2002. Plaintiffs now refer to that as “a mere partial inspection” 18 without any explanation and without any basis for suggesting that more personal information is contained on the servers. Such unsupported and speculative assertions cannot defeat a motion for summary judgment. B. Knoim Emms From Third Parties Caused the Collection of Personal Data Defendants have provided undisputed descriptions of how pieces of personal information were transmitted to their servers. According to the Defendants, programming errors made by three different third parties caused these transmissions. One hundred sixty-six transmissions were the result of the inappropriate use of the GET method19 by two of the Defendant pharmaceutical companies, while the remaining sixty-seven occurred because of a mistake in Netscape’s Navigator browser.20 Because the transmissions were the result of circumstances beyond their control, Defendants argue that they could not have intended to collect the information. Their assertion is supported by the First Circuit’s definition of intentional: “Since one has no control over the existence of circumstances, one cannot ‘intend’ them.”21 Plaintiffs do not dispute the descriptions of how the information was transmitted. But they attempt to circumvent the conclusion by arguing that, because Pharmatrak did not implement certain safeguards to prevent these sorts of transmissions, it must have intended to collect personal data.22 It is beside the point, however, whether such safeguards existed and whether they could have been used to prevent these transmissions. Even assuming that they did exist and could have been used, Pharmatrak would at most be liable [268] under a theory of negligence, or even gross negligence. Neither is sufficient to satisfy the specific intent requirement under the EPCA. Testimony by Plaintiffs’ expert cannot change the situation. While experts may testify to facts from which a jury may find the requisite intent, no expert may opine about a criminal defendant’s intent when, as here, intent is an element of the alleged crime.23 Plaintiffs’ expert would not be permitted to testify that Pharmatrak acted intentionally. He would only be able to lay out the facts as they have been detailed in Plaintiffs’ opposition to this summary judgment motion. C. Pharmatrak Had No Knowledge of the Personal Data Until After the Lawsuit Was Filed Defendants’ final argument in support of its summary judgment motion is that no one at Pharmatrak even knew that it had collected any personal data during its years in operation. Pharmatrak’s former Chief of Technology stated in his deposition that “NETcompare was not designed and there was no intent and there was no active designer intent to collect personal, personally identifying, private or sensitive information about any particular individual.”24 He also testified that he did not learn about the collection of personal information until April, 2002, which was more than a year and a half after Plaintiffs filed this suit.25 Plaintiffs offer no evidence to contradict these statements. They have provided no testimony that indicates that anyone at Pharmatrak intentionally sought to collect personal data through its NETcompare program. CONCLUSION For the foregoing reasons, Defendants’ Motion for Summary Judgment by Phar-matrak and Glocal on Plaintiffs’ Claim Under 18 U.S.C. § 2511 [Docket #294] is ALLOWED. Footnotes [1] For a detailed factual account of this action, see In Re Pharmatrak, Inc. Privacy Litig., 220 F.Supp.2d 4 (D.Mass.2002). [2] In re Pharmatrak, Inc., 220 F.Supp.2d at 15. [3] 18 U.S.C. § 2510 et. seq. [4] See In re Pharmatrak, Inc. Privacy Litig., 329 F.3d 9 (1st Cir.2003). [5] The Court of Appeals held that Pharmat-rak’s behavior might be in violation of § 2511(a)(1) because its actions did not fall within the statute's consent exception. In re Pharmatrak, Inc., 329 F.3d at 19-22. The EPCA provides for a private right of action, but it is subject the following statutory exception: "(d) It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act ...." 18 U.S.C. § 2511 (2)(d). [6] Title I of the EPCA, Interception of Electronic Communications, provides that: "Except as otherwise specifically provided in this chapter[,] any person who — (a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept, any wire, oral, or electronic communication ... shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5).” 18 U.S.C. § 2511 (l)(a). [7] Fed.R.Civ.P. 56(c). [8] Celotex Corp. v. Catrett, 477 U.S. 317, 322, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). [9] Blackie v. Maine, 75 F.3d 716, 721 (1st Cir.1996) (quotations omitted). [10] Griggs-Ryan v. Smith, 904 F.2d 112, 115 (1st Cir.1990) (citations omitted). [11] 18U.S.C. § 2511(l)(a). [12] Id. at 23. [13] Id. (citing S.Rep. No. 99-541, at 23 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3577). [14] Id. [15] Macinta Supp. Aff. ¶ 17. [16] Id. at ¶¶ 17-18. [17] Pis'. Opp’n Defs'. Mot. Summ. J. at 8 n. 11. [18] Id. [19] As the First Circuit explained, “Web servers use two methods to transmit information entered into online forms: the get method and the post method. The get method is generally used for short forms such as the 'Search' box at Yahoo! and other online search engines. The post method is normally used for longer forms and forms soliciting private information. When a server uses the get method, the information entered into the online form becomes appended to the next URL. For example, if a user enters 'respiratory problems' into the query box at a search engine, and the search engine transmits this information using the get method, then the words 'respiratory' and 'problems' will be appended to the query string at the end of the URL of the webpage showing the search results. By contrast, if a website transmits information via the post method, then that information does not appear in the URL.” In re Pharmatrak, Inc. Privacy Litig., 329 F.3d 9, 15 (1st Cir.2003). [20] Macinta Supp. Aff. at ¶¶ 24-25, 26(A). [21] In re Pharmatrak, Inc., 329 F.3d at 23. [22] Pis’. Opp'n Defs'. Mot. Summ. J. at 9-11. [23] United. States v. Valle, 72 F.3d 210, 216 (1st Cir.1995). [24] Sonnenreich Dep. at 206-08. [25] Id.