Singapore Ministry of Health v. Farrera-Brochez

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF KENTUCKY CENTRAL DIVISION (at Lexington) SINGAPORE MINISTRY OF HEALTH, ) ) Plaintiff, ) Civil Action No. 5: 19-051-DCR ) V. ) ) MIKHY K. FARRERA-BROCHEZ, ) MEMORANDUM OPINION ) AND ORDER Defendant. ) *** *** *** *** Plaintiff Singapore Ministry of Health (“MOH”) has filed a motion for summary judgment and entry of a permanent injunction to prevent Defendant Mikhy Farrera-Brochez (“Brochez”) and his agents from making further attempts to obtain or disclose confidential information wrongfully obtained from the Government of Singapore. [Record No. 32] Because MOH has established that Brochez invaded its privacy by obtaining and disseminating confidential health records, MOH’s motion for summary judgment will be granted. Additionally, Brochez, his agents, and those working in active concert or participation with him will be permanently enjoined from making additional attempts to acquire or disclose MOH’s confidential information. I. Brochez is an American citizen who resided in Singapore between 2008 and 2018. [Record No. 9-1 at ¶¶ 13, 23] During that time, Brochez was involved in a relationship with Ler Teck Siang (“Ler”), a Singaporean doctor who was the head of MOH’s National Public Health Unit from March 2012 to May 2013. Id. at ¶ 16. Ler was one of a very limited number of individuals who had access to MOH’s Human Immunodeficiency Virus Registry (“HIV Registry”), which contained the confidential health information of approximately 14,200 individuals diagnosed with HIV. Brochez obtained the HIV Registry, likely as a result of Ler’s mishandling of the information, and began disclosing its contents to others by 2016. Id. at ¶ 20. [See also Record No. 1-2, pp. 3-4.] Brochez was deported from Singapore in April 2018 after completing a 28-month prison sentence for fraud and drug-related offenses. Id. at ¶¶ 21, 23. Following his return to the United States, Brochez continued to share the ill-gotten information, which included the registrants’ names, unique identification numbers, contact information, HIV test results, and related medical information, with various people, the press, and United States agencies. Id. at ¶¶ 28-31. [See also Record Nos. 1-1 MOH Statement (Feb. 13, 2019), 1-3 Facebook post (undated), 1-4 Vice News article (Feb. 13, 2019), 1-5 Straits Times article (Feb. 2, 2019).] In addition to the HIV Registry, Brochez obtained and disclosed a list of HIV-positive individuals who were scheduled for medical check-ups in Singapore’s Changi Prison Complex (“the Prisons list”). [Record No. 9-1 at ¶ 40] The MOH instituted this action in February 2019 seeking an injunction requiring Brochez to remove and/or surrender any remaining confidential information and to refrain from making further disclosures of it. This Court entered a temporary restraining order and later a preliminary injunction granting the relief sought. [Record Nos. 10, 20, 24] Brochez submitted an affidavit on March 29, 2019, stating that “all information obtained from the Singapore Government has been, or will be, deleted.” [Record No. 27-1] Brochez was indicted on criminal charges arising out of these incidents on March 7, 2019. [See Lexington Criminal Action No. 5: 19-055-DCR.] Following a two-day jury trial held in June 2019, Brochez was convicted of all charges: two counts of sending a threatening e-mail to extort things of value from the Government of Singapore and one count of transferring and possessing a means of identification of another person in connection with threatening interstate communications. He was later sentenced to concurrent terms of 24 months of imprisonment on each count. MOH filed a motion for summary judgment and for a permanent injunction in this matter on August 29, 2019. [Record No. 32] Specifically, MOH requests judgment in its favor regarding its invasion-of-privacy claim and seeks to ensure that Brochez will delete, remove, and/or return all confidential information and will make no attempts to access or disclose it in the future. Brochez did not respond MOH’s motion. II. Summary judgment is appropriate when “the pleadings, discovery and disclosure materials on file, and any affidavits show that there is no genuine issue as to any material fact and that the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317 , 323–25 (1986); Chao v. Hall Holding Co., 285 F.3d 415, 424 (6th Cir. 2002). A dispute over a material fact is not “genuine” unless a reasonable jury could return a verdict for the nonmoving party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242 , 247- 48 (1986). The determination must be “whether the evidence presents a sufficient disagreement to require submission to a jury or whether it is so one-sided that one party must prevail as a matter of law.” Anderson, 477 U.S. at 251–52; see Harrison v. Ash, 539 F.3d 510, 516 (6th Cir. 2008). Typically, once a moving party has met its burden of production, “its opponent must do more than simply show that there is some metaphysical doubt as to the material facts.” Keeneland Ass’n, Inc. v. Earnes, 830 F. Supp. 974, 984 (E.D. Ky. 1993) (citing Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586 (1986)). But when the nonmoving party fails to respond to a motion for summary judgment, the Court still must determine whether there are any genuine issues of fact and whether the moving party is entitled to judgment as a matter of law. In the absence of a response by the nonmoving party, however, “the court may rely on the moving party’s unrebutted recitation of the evidence, or pertinent portions thereof, in reaching a conclusion that certain evidence and inferences from evidence demonstrate facts which are uncontroverted.” Guarino v. Brookfield Twp. Trustees, 980 F.2d 399 , 403 (6th Cir. 1992). MOH seeks summary judgment on its claim of invasion of privacy. In Kentucky, invasion of privacy can take on various forms. See McCall v. Courier-Journal & Louisville Times Co., 623 S.W.2d 882, 887 (Ky. 1981). MOH claims that Brochez invaded its privacy by intruding upon its seclusion and by bringing unreasonable publicity upon the private lives of others. While it is nearly certain that Brochez brought unreasonable publicity upon the private lives of individuals included in the HIV Registry and the Prisons list, those individuals are not plaintiffs in this action. MOH has not explained why it has standing to bring invasionof-privacy claims on their behalf, so the Court will focus on the claim that Brochez’s actions constituted an intrusion upon MOH’s seclusion. Kentucky has adopted the standards set forth in the Restatement. Accordingly, to prevail on this claim, MOH must show an intentional intrusion by the defendant into a matter the plaintiff has a right to keep private which is highly offensive to a reasonable person. Restatement (Second) Torts § 652B (1976); Zhang v. Western Ky. University, No. 2011-CA287-MR, 2012 WL 4464448 , at *9-10 (Ky. Ct. App. Sept. 28, 2012); Smith v. Bob Smith Chevrolet, Inc., 275 F. Supp.2d 808, 822 (W.D. Ky. 2003). Examples include an unauthorized investigation into an individual’s private concerns such as opening private mail, searching a person’s safe or wallet, examining a person’s bank account, or presenting a forged court order to permit inspection of personal documents. Restatement (Second) Torts § 652B cmt. b. Without question, personal health information such as HIV test results constitutes a private concern of those included in the HIV Registry. However, MOH has established that the information contained in the HIV Registry constitutes its private concern, as well. As the plaintiff points out, privacy in HIV testing is a recognized public concern under Kentucky law. The General Assembly has concluded that “the public health will be served by facilitating informed, voluntary, and confidential, use of tests designed to detect [HIV].” KRS § 214.181(1) (emphasis added). Additionally, the General Assembly cautions that HIV testing results may be disclosed only to a limited group of authorized individuals. Id. at (5)(d). The MOH has provided its own public policy reasons for keeping its HIV information confidential. MOH “educate[s] the public on healthy lifestyles.” [Record No. 32-2, p. 4] A public MOH website provides as follows: “MOH relies on information from the Registry to monitor the HIV infection situation, conduct contract tracing in relation to HIV patients and assess disease prevention and management measures.” [Record No. 9-1, p. 20] MOH also works to educate the public regarding HIV rates in Singapore. (“Statistics on HIV infection rates from the HIV Registry are published annually.”). Id. at p. 21. MOH’s goals are possible only to the extent that Singapore citizens undergo HIV testing. It is reasonable to assume that Brochez’s actions have created fear regarding disclosure of citizens’ HIV status, resulting in reduced testing. In addition to reputational harm, MOH has incurred economic harm as it has attempted to minimize the effects of Brochez’s actions. [Record No. 32-6, ¶¶ 9-10] And here, Brochez’s conduct was intentional. [See Record No. 1-4, p. 5 (“Giving [the Registry] to the press, I was hoping that somebody would get a look at what has been going on in Singapore and how they are using that registry to track individuals with HIV and men who have sex with men.”).] Additionally, his conduct would be highly offensive to a reasonable person. See, e.g., In re Viziom Inc., Consumer Privacy Litigation, 238 F. Supp. 3d 1204 (C.D. Cal. 2017) (“collection of intimate or sensitive personally identifiable information may amount to a highly offensive intrusion.”); Melo v. Barnett, 157 S.W.3d 596, 597 (Ky. 2005) (plaintiff quit job due to “uncomfortable office environment” after medical provider disclosed HIV status that plaintiff had intentionally kept private from employer); Toomer v. Garrett, 574 S.E.2d 76, 90 (N.C. Ct. App. 2002) (unauthorized examination of personnel file, especially where it contains sensitive information such as medical diagnoses “would be highly offensive to a reasonable person”). Based on the foregoing, the Court is satisfied that there is no genuine issue of material fact concerning MOH’s success on each element of its invasion-of-privacy claim. Accordingly, the Court will grant summary judgment in MOH’s favor. III. The standard for granting a permanent injunction is essentially the same as that for a preliminary injunction, except that the plaintiff must show actual success on the merits rather than a mere likelihood of success. Herrell v. Benson, 261 F. Supp. 3d 772, 776 (E.D. Ky. 2017) (citing Amoco Prod. Co. v. Village of Gambell, 480 U.S. 531 , 546 n.12 (1987)). A plaintiff seeking a permanent injunction also must demonstrate that (1) it has suffered an irreparable injury; (2) there is no adequate remedy at law; (3) considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted; and (4) it is in the public’s interest to issue an injunction. Audi AG v. D’Amato, 469 F.3d 534, 550 (6th Cir. 2006) (citing eBay Inc. v. MercExchange, LLC, 126 S. Ct. 1837 , 1839 (2006)). Inasmuch as the Court has determined that summary judgment should be entered in MOH’s favor with respect to its invasion-of-privacy claim, the first requirement is satisfied. Additionally, MOH has established that it has suffered an irreparable injury. An injury is irreparable when it cannot be fully compensated by money damages. See Overstreet v. Lexington-Fayette Urban Cty. Gov., 305 F.3d 566, 578 (6th Cir. 2002). See also United States v. Miami Univ., 294 F.3d 797, 819 (6th Cir. 2002) (“An injury is not fully compensable by money damages if the nature of the plaintiff’s loss would make damages difficult to calculate.”). It would be virtually impossible to place a value on MOH’s damages. While it might be possible to approximate MOH’s economic loss, the non-economic harms have far broader implications. First, the plaintiff cannot be compensated monetarily for the Singaporean citizens’ (including those on the HIV Registry) loss of confidence in the MOH and in the Singaporean Government in general. Reduced compliance with HIV testing and other public health measures that may result from the data breach also cannot be remedied with a monetary award. On the contrary, MOH must be able to assure the public that the breach has been resolved before it can rebuild its prior position of trust with the public. [See Record No. 32-2, p. 6] The next factor (i.e., whether there is an adequate remedy at law) overlaps with the inquiry concerning irreparable harm. “An adequate remedy at law is a remedy that is plain and complete and as practical and efficient to the ends of justice as the remedy in equity by injunction.” USACO Coal Co. v. Carbomin, 689 F.2d 94, 99 (6th Cir. 1982). MOH has provided several reasons that equitable relief is necessary under these circumstances. First, although Brochez provided an affidavit indicating that all confidential information “[had] been, or [would] be, deleted,” the actual status of the information is unknown. MOH is particularly troubled by portions of Brochez’s trial testimony indicating that copies of the confidential information were left with various individuals and in multiple countries. [Record No. 32, p. 3 (discussing Brochez’s testimony indicating that copies were located in Indonesia, Philippines, the United States, and Canada)] Additionally, absent a permanent injunction, there is a reduced likelihood that Brochez will follow through with his promise to return or delete the materials upon his release from custody. Brochez’s trial testimony reflects a continued hostility toward MOH and the Singaporean Government. [Record No. 32-3] Since his conviction in the criminal case, he has peppered the Court with correspondence suggesting that the Singaporean Government has committed numerous offenses against him. [Lexington Criminal Action No. 5: 19-055, Record Nos. 41, 51, 54] MOH reasonably fears that, absent permanent injunctive relief, Brochez will retain the confidential information and attempt to use it to retaliate against the Singaporean Government after he is released from custody. The remaining factors also weigh in favor of granting injunctive relief. The balance of hardships clearly weighs in MOH’s favor. First, Brochez has no legitimate interest in possessing the confidential information in the first place. Regardless of how he obtained it, it is undisputed that the HIV Registry is a confidential database and Brochez had no lawful right to access or possess it. Further, only Brochez knows precisely what he has done with the information (e.g., where he has stored it, how to access it, with whom he has shared it). His relative ability to retrieve the information and return it to MOH (or destroy it) is minimal compared with MOH’s ability to obtain and/or prevent further disclosure without Brochez’s cooperation. Finally, for many of the reasons already discussed, the public interest would be served by issuing a permanent injunction. First and foremost, the individuals whose private health information is at risk need assurance that their information will not be subject to further unauthorized disclosure. MOH has strong public policies that include educating groups at risk for HIV, determining who may have been exposed to HIV and asking them to get tested, and providing medical care to HIV patients. [Record No. 32-2, p. 7] Put simply, if the public cannot trust that MOH is able to keep their health information confidential, MOH will be less able to achieve these important goals. IV. Based on the foregoing analysis and discussion, it is hereby ORDERED as follows: 1. The plaintiff’s motion for summary judgment and a permanent injunction [Record No. 32] is GRANTED. 2. Defendant Mikhy K. Farrera-Brochez is PERMANENTLY ENJOINED from possessing, controlling, posting, disclosing, referencing, discussing, saving, uploading, or disseminating (or attempting to do any of the foregoing) any confidential, sensitive, or private information obtained from the Singapore Government (including the Singapore Ministry of Health and the Singapore Prisons Service), including but not limited to, the HIV Registry, the Prisons List, files related to hospital services and to other infectious diseases, as well as other information such as emails, HIV studies, and reports. 3. Any agent, representative, companion, friend, or acquaintance acting in concert or participation with the defendant, in possession of any confidential, sensitive, or private information obtained from the Singapore Government (including the Singapore Ministry of Health and the Singapore Prisons Service), including but not limited to, the HIV Registry, the Prisons List, files related to hospital services and to other infectious diseases, as well as other information such as emails, HIV studies and reports is PERMANENTLY ENJOINED from possessing, controlling, posting, disclosing, referencing, discussing, saving, uploading, or disseminating (or attempting to do any of the foregoing). 4. Defendant Mikhy K. Farrera-Brochez is DIRECTED TO DELIVER to the Singapore Ministry of Health or its designated representative all copies of any confidential, sensitive, or private information obtained from the Singapore Government (including the Singapore Ministry of Health and the Singapore Prisons Service) in his possession or control (whether in electronic or hard copy form), including any and all information related to or obtained from the HIV Registry, the Prisons List, files related to hospital services and to other infectious diseases, as well as other information such as emails, HIV studies and reports AND IS DIRECTED TO CERTIFY to the Court that all such return has been effected by no later than 30 DAYS AFTER HIS RELEASE FROM FEDERAL DETENTION. The return of the materials and information shall be done in such a way to preserve their confidentiality. 5. Defendant Mikhy K. Farrera-Brochez IS DIRECTED TO PERMANENTLY DELETE all confidential, sensitive, or private information obtained from the Singapore Government (including the Singapore Ministry of Health and the Singapore Prisons Service) saved or uploaded to any computer, device, electronic storage media, online website, platform, database, or other location, AND IS DIRECTED TO CERTIFY to the Court that all such deletions have occurred and provide the details of such deletions (including but not limited to what he has deleted, from where, when, and how) BY NOT LATER THAN 30 DAYS AFTER HIS RELEASE FROM FEDERAL DETENTION. 6. Defendant Mikhy K. Farrera-Brochez IS DIRECTED TO REMOVE all online posts and references, including on all social media platforms that refer to the presence or existence of any confidential, sensitive, or private information obtained from the Singapore Government (including the Singapore Ministry of Health and the Singapore Prisons Service), or any data leak in relation to such confidential information, and is PROHIBITED from making further such posts or references. Brochez shall CERTIFY to the Court that all such removals have occurred and provide the details of such removals (including but not limited to what he has deleted, from where, when and how) BY NO LATER THAN 30 DAYS AFTER HIS RELEASE FROM FEDERAL DETENTION. 7. Any agent, representative, companion, friend, or acquaintance acting in concert or participation with the defendant, in possession or control of the confidential, sensitive, or private information obtained from the Singapore Government (including the Singapore Ministry of Health and the Singapore Prisons Service), and including the HIV Registry, the Prisons List, files related to hospital services and to other infectious diseases, as well as other information such as emails, HIV studies and reports shall DELETE and REMOVE any and all confidential information in his/her/its possession and power, including copies saved or uploaded on any online website, platform, or other database. 8. Nothing in this Order shall be construed to limit the authority or ability of MOH to protect the interests of the people of Singapore and all of the affected individuals. This Order shall not bar MOH from enforcing its laws, regulations, or rules against the defendant for conduct subsequent to or otherwise not covered by this Order. Further, nothing in this Order shall be construed to limit the ability of MOH to enforce the defendant’s obligations under this Order. 9. Nothing in this Order shall be construed as relieving the defendant of the obligation to comply with all state and federal laws, regulations, and rules, nor shall any of the provisions of this Order be deemed permission to engage in any acts or practices prohibited by such laws, regulations, or rules. 10. Willful violation of this Order may subject any person who commits such an act to criminal and/or civil prosecution for contempt of this Court. 11. This matter is STAYED pending the defendant’s report to the Court WITHIN 30 DAYS OF RELEASE FROM CUSTODY. Dated: November 25, 2019. “clo. —_ apn CP ae ee Danny C. Reeves. Chief Judge Male7 (United States District Court ice" — Eastern District of Kentucky -12-