J.R. et al v. Walgreens Boots Alliance Inc et al

Filing 162

ORDER granting 135 Motion to Dismiss; granting 135 Motion to Dismiss for Failure to State a Claim Signed by Honorable David C Norton on July 2, 2020.(kwhe, )

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF SOUTH CAROLINA
CHARLESTON DIVISION
J.R., individually and on behalf of her minor
)
children A.R. and H.K., J.H., B.Y., and J.S.,
)
individually and on behalf of all others similarly )
situated,
)
)
Plaintiffs,
)
)
vs.
)
)
WALGREENS BOOTS ALLIANCE, INC. and )
WALGREEN CO.,
)
)
Defendants.
)
_______________________________________)

No. 2:19-cv-00446-DCN
ORDER

The following matter is before the court on defendants Walgreens Boots Alliance,
Inc. (“WBA”) and Walgreen Co.’s (collectively, “Walgreens”) motion to dismiss the
amended complaint and to dismiss WBA for lack of personal jurisdiction, ECF No. 135.
For the reasons set forth below, the court grants the motion.
I. BACKGROUND
This case arises from Walgreens’s alleged violation of plaintiffs J.R., J.H., B.Y.,
and J.S.’s (collectively, “plaintiffs”) privacy rights by unlawfully using, disclosing, and
disseminating plaintiffs’ personally identifiable information (“PII”) through Walgreens’s
340B Complete® services (“340B Complete”). Plaintiffs are all residents of Charleston,
South Carolina and customers of Walgreens pharmacies. Plaintiffs allege that WBA uses
three divisions to conduct its operations: Retail Pharmacy USA, Retail Pharmacy
International, and Pharmaceutical Wholesale. Walgreen Co. is the wholly-owned
subsidiary of WBA that operates the Retail Pharmacy USA division of WBA, meaning
Walgreen Co. operates all of the Walgreens pharmacy locations in South Carolina.
1

A. Walgreens Pharmacy Operations in South Carolina
Plaintiffs begin by explaining that each Walgreens pharmacy is required to
comply with South Carolina’s Prescription Information Privacy Act (“PIPA”), the South
Carolina Pharmacy Practice Act (“PPA”), and the American Pharmaceutical Association
Code of Ethics. In addition, South Carolina law requires each Walgreens pharmacy to
operate with a pharmacist-in-charge, who is responsible for compliance with the law and
management of the pharmacy and its personnel. Walgreens uses a Notice of Privacy
Practices (“NPP”) in its pharmacies, and plaintiffs allege that the NPP contains no
mention of 340B Complete.
Plaintiffs allege that Walgreens pharmacy customers provide their PII to
Walgreens’s pharmacies for the purpose of obtaining their individual prescriptions and to
allow Walgreens’s pharmacy to seek third-party payment for those prescriptions. In
doing so, Walgreens inputs pharmacy customers’ PII into a “proprietary computer
software system” called IntercomPlus, which is accessible by all nationwide retail, mail
service, and specialty Walgreens pharmacies. Am. Compl. ¶ 42. The PII that is collected
and inputted into IntercomPlus includes the pharmacy customer’s name, address, date of
birth, payment information, allergies, health conditions, drug information, and physician
information.
B. 340B Complete
In 1992, Congress enacted the 340B Drug Discount Program (“340B Program”),
which requires drug manufacturers to provide certain medications at discounted prices to
eligible healthcare entities that primarily serve low-income patients (“Covered Entities”).
Because not all Covered Entities have in-house pharmacy services, Covered Entities

2

contract with third-party pharmacies (“contract pharmacies”) to dispense 340B drugs on
their behalf. When doing so, Covered Entities are still responsible for ensuring
compliance with the 340B Program. Walgreens has entered into multiple contracts with
Covered Entities in South Carolina to serve as contract pharmacies.
Around 2010, Walgreens created an allegedly separate department, division, or
unit within its corporate structure known as 340B Complete and began marketing its
340B Complete services to help Covered Entities administer the 340B Program and to
ensure compliance. Plaintiffs allege that Walgreens operates 340B Complete “as an
independent line of business, separate from its retail, photo, health clinic, or pharmacy
lines of business, and functions on its own” and promotes 340B Complete “as a
‘prescription eligibility verification solution’ with ‘comprehensive’ and ‘advanced online
reporting and data-capture tools,’ providing a single vendor ‘end-to-end contract
pharmacy solution.’” Am. Compl. ¶ 56. Plaintiffs allege that Walgreens markets access
to its entire database of pharmacy customers’ PII to potentially capture all patients who
received care from a Covered Entity and would therefore be eligible for 340B discounted
drugs.
Walgreens’s alleged 340B Complete process is as follows. Walgreens allegedly
transfers on a daily basis all of its pharmacy customers’ PII from IntercomPlus to a
“corporate central repository” called Enterprise Data Warehouse (“EDW”). Am. Compl.
¶ 68. Plaintiffs allege that EDW is not a secure platform and that “unauthorized persons
and other Walgreens’ departments, divisions, and/or units can and do unlawfully access
pharmacy customers’ PII contained therein.” Id. ¶ 69. Plaintiffs allege that 340B
Complete receives and scans EDW, compares it to the patient database received by

3

Covered Entities, and then transfers PII of those patients of the Covered Entities into
340B Complete.
According to plaintiffs, one of the business purposes behind 340B Complete is to
acquire 340B drugs for resale at Walgreens’s pharmacies at prices significantly below the
price that Walgreens pays in the wholesale market. Walgreens allegedly performs a
financial analysis to determine whether a profit margin on a 340B drug exceeds the
Covered Entity’s fees paid to Walgreens, and if it does, 340B Complete will generate a
purchase order for the drug. If the profit margin does not exceed the fee, 340B Complete
will not generate a purchase order for the 340B drug, will not charge fees to the Covered
Entity, and will retain its usual non-340B profit margin. Plaintiffs allege that 340B
Complete is outside of the scope of Walgreens’s pharmacies’ normal operations, and that
these administration services are not provided to its pharmacy customers. Covered
Entities compensate Walgreens for its provision of services through 340B Complete, and
Walgreens allegedly realizes substantial profits from 340B Complete.
There are 160 employees in Walgreens’s 340B Complete department, and
plaintiffs allege that those employees all have unauthorized and unconsented access to
pharmacy customers’ PII. Those employees are allegedly not registered with South
Carolina’s State Board of Pharmacy, do not maintain pharmacy licensure in South
Carolina, and do not provide pharmacy care services.
Plaintiffs filed their complaint and a motion for a preliminary injunction on
February 14, 2019. After briefing and limited discovery, the court held a two-day
evidentiary hearing on the motion for a preliminary injunction and issued an order
denying the motion. This order is currently on appeal.

4

After appealing the court’s order, plaintiffs filed an amended complaint. ECF No.
128. The amended 56-page, 280-paragraph complaint brings claims for: (1) invasion of
privacy: wrongful appropriation; (2) invasion of privacy: wrongful publicizing of private
affairs; (3) violation of the Fair Credit Reporting Act (“FCRA”); (4) negligence per se
based on violations of FCRA, the Health Insurance Portability and Accountability Act
(“HIPAA”), and the Federal Trade Commission Act (“FTCA”); (5) negligence per se
based on violations of PIPA; (6) breach of contract; (7) declaratory relief pursuant to 28
U.S.C. § 2201; (8) negligence based on professional standards; (9) negligence based on
PPA; (10) respondeat superior; (11) negligent training and supervision; and (12) unjust
enrichment. Walgreens filed a motion to dismiss the amended complaint and to dismiss
Walgreens Boots Alliance, Inc. (“WBA”) for lack of personal jurisdiction on January 9,
2020. ECF No. 135. Plaintiffs responded on February 24, 2020, ECF No. 143, and
Walgreens replied on April 8, 2020, ECF No. 147. On May 18, 2020, plaintiffs filed
additional exhibits to their response brief that were not discussed in the brief, ECF No.
154, and on May 19, 2020, plaintiffs filed a “request that the court take judicial notice of
facts contained in plaintiffs’ additional exhibits in support of” their response brief, ECF
No. 155. The court held a hearing on the motion on May 19, 2020.
II. STANDARD
A. Motion to Dismiss for Lack of Personal Jurisdiction
When the defendant challenges personal jurisdiction, the plaintiff has the burden
of showing that jurisdiction exists. See In re Celotex Corp., 124 F.3d 619, 628 (4th Cir.
1997). When the court decides a personal jurisdiction challenge without an evidentiary
hearing, the plaintiff must prove a prima facie case of personal jurisdiction. See Mylan

5

Labs., Inc. v. Akzo, N.V., 2 F.3d 56, 60 (4th Cir. 1993). “In considering the challenge on
such a record, the court must construe all relevant pleading allegations in the light most
favorable to the plaintiff, assume credibility, and draw the most favorable inferences for
the existence of jurisdiction.” In re Celotex Corp., 124 F.3d at 628 (quoting Combs v.
Bakker, 886 F.2d 673, 676 (4th Cir. 1989)). However, the court need not “credit
conclusory allegations or draw farfetched inferences.” Masselli & Lane, PC v. Miller &
Schuh, PA, 2000 WL 691100, at *1 (4th Cir. May 30, 2000) (quoting Ticketmaster-New
York, Inc. v. Alioto, 26 F.3d 201, 203 (1st Cir. 1994)).
B. Motion to Dismiss for Failure to State a Claim
A Rule 12(b)(6) motion for failure to state a claim upon which relief can be
granted “challenges the legal sufficiency of a complaint.” Francis v. Giacomelli, 588
F.3d 186, 192 (4th Cir. 2009) (citations omitted); see also Republican Party of N.C. v.
Martin, 980 F.2d 943, 952 (4th Cir. 1992) (“A motion to dismiss under Rule 12(b)(6) . . .
does not resolve contests surrounding the facts, the merits of a claim, or the applicability
of defenses.”). To be legally sufficient, a pleading must contain a “short and plain
statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P.
8(a)(2). A Rule 12(b)(6) motion should not be granted unless it appears certain that the
plaintiff can prove no set of facts that would support his claim and would entitle him to
relief. Mylan Labs., Inc. v. Matkari, 7 F.3d 1130, 1134 (4th Cir. 1993). When
considering a Rule 12(b)(6) motion, the court should accept all well-pleaded allegations
as true and should view the complaint in a light most favorable to the plaintiff.
Ostrzenski v. Seigel, 177 F.3d 245, 251 (4th Cir.1999); Mylan Labs., Inc., 7 F.3d at 1134.
“To survive a motion to dismiss, a complaint must contain sufficient factual matter,

6

accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v.
Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544,
570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content
that allows the court to draw the reasonable inference that the defendant is liable for the
misconduct alleged.” Id.
III. DISCUSSION
Walgreens argues that each cause of action in the amended complaint should be
dismissed, and it also argues that WBA should be dismissed for lack of personal
jurisdiction. The court first addresses the personal jurisdiction issue and then turns to
Walgreens’s motion to dismiss.
A. Motion to Dismiss for Lack of Personal Jurisdiction
Walgreens argues that this court lacks personal jurisdiction over WBA. In
response, plaintiffs first argue that WBA has waived any personal jurisdiction defense
and then contends that even if WBA has not waived the defense, the court has personal
jurisdiction over WBA through the alter ego theory of jurisdiction. The court addresses
each in turn.
a. Waiver
Plaintiffs argue that WBA has waived its jurisdictional defense because it has
participated in this litigation for over a year, including conducting limited discovery,
participating in the two-day preliminary injunction hearing, and agreeing to the
confidentiality order, and only now asserts its jurisdictional defense. Plaintiffs note that
both WBA and Walgreen Co. have included in their filings a footnote reserving any and
all defenses, but that Rule 12(h) requires WBA to raise its jurisdictional defense, not

7

merely to reserve it. According to plaintiffs, WBA should have already raised its defense
but failed to do so, meaning that the defense has been waived.
The problem with this argument is that it is contrary to the plain language of Rule
12 of the Federal Rules of Civil Procedure. Pursuant to Rule 12(h)(1), a party must raise
its lack of personal jurisdiction defense in its answer to the complaint or in a motion
under the rule, such as the instant motion. While litigation has been ongoing for the past
year, the procedural posture of the case is such that the court is just now considering
Walgreens’s motion to dismiss. Indeed, the court entered an order on March 11, 2019
giving Walgreens 14 days following the court’s ruling on the motion for a preliminary
injunction to respond to the complaint. The court’s ruling took place on October 4, 2019,
and Walgreens filed its motion to dismiss on October 18, 2019, in which WBA raised its
jurisdictional defense.1 As such, WBA has complied with Rule 12(h) and has not waived
its defense.
Plaintiffs argue that WBA should have raised its jurisdictional defense at the
preliminary injunction hearing, but doing so would contradict Rule 12(h)(1). Rule
12(h)(1) requires a party to raise its jurisdictional defense in its answer or its motion to
dismiss. Plaintiffs’ argument about WBA’s participation in the preliminary injunction
adjudication sticks WBA between Scylla and Charybdis. Either WBA doesn’t participate
in limited discovery and the hearing on the preliminary injunction in order to preserve its
jurisdictional defense but sacrifices its opportunity to defend itself from a preliminary

1

Walgreens originally filed a motion to dismiss the original complaint in which it
argued that the court lacked personal jurisdiction over WBA. ECF No. 117. Walgreens
filed a new motion to dismiss, which is the one currently before the court, after plaintiffs
filed an amended complaint.
8

injunction or WBA defends itself but waives its chance to assert its jurisdictional defense.
That is an untenable position. Finally, the cases cited by plaintiffs are inapposite. In
Ashley II of Charleston, LLC v. PCS Nitrogen, Inc., the court found that a party waived
several defenses because the party failed to substantively argue them until after judgment
was entered, which is clearly not the case here. 791 F. Supp. 2d 431, 510 (D.S.C. 2011),
aff’d, 714 F.3d 161 (4th Cir. 2013). Similarly, in Alger v. Hayes, the Eighth Circuit
found that the party was playing “fast and loose” with the court’s power by indicating
that it would only consent to jurisdiction if the verdict was favorable to the party, which
again is not what happened here. 452 F.2d 841, 845 (8th Cir. 1972). In sum, the court
finds that WBA has not waived its ability to assert its jurisdictional defense.
b. Alter Ego Theory
Walgreens argues that the court does not have general or specific personal
jurisdiction over WBA. Walgreens contends that general personal jurisdiction does not
exist because WBA is incorporated under the laws of Delaware and its
headquarters/principal place of business are in Illinois, and there is no specific personal
jurisdiction because WBA does not operate Walgreens pharmacies in South Carolina.
Instead, it is Walgreen Co., a subsidiary of WBA, that operates the pharmacies, contracts
with Covered Entities, and administers 340B Complete in South Carolina. In response,
plaintiffs do not dispute these arguments but instead contend that the court has personal
jurisdiction over WBA through the alter ego theory, in that WBA is the alter ego of
Walgreen Co.
Before diving into the substance of the parties’ arguments, the court first
addresses plaintiffs’ late filing of additional exhibits related to this issue and their request

9

that the court take judicial notice of the facts contained within the exhibits. On the day
before the hearing, plaintiffs filed additional exhibits to their response brief that they did
not address in the brief, and on the morning of the hearing, plaintiffs submitted another
filing requesting that the court take judicial notice of the facts within those exhibits. The
exhibits consist of press releases, pages from WBA’s website, and a settlement order, all
of which well pre-date plaintiffs’ response brief and thus could have been timely filed
with the response brief. Instead, and presumably based on some strategy2, plaintiffs filed
these additional exhibits at the eleventh hour. At the hearing, Walgreens objected to the
court’s consideration of these untimely exhibits, argued that the exhibits do not support a
finding of personal jurisdiction based on the alter ego theory, and requested the
opportunity to provide supplemental briefing on the issue.
While the court certainly does not condone the questionable tactic of failing to file
all available exhibits with a party’s brief, the court will consider plaintiffs’ additional
exhibits. The issue of personal jurisdiction is one of the utmost importance, and the court
feels obligated to consider all of the evidence before it when making its ruling.
Walgreens was able to respond to these eleventh hour exhibits at the hearing, and the
court is able to resolve the issue of personal jurisdiction without the need for
supplemental briefing. However, the court stresses that it does not view this gambit
favorably, and should plaintiffs try something like this again, the court will not be as
generous.
In determining whether to exercise jurisdiction based on the alter ego theory, the
court considers the following factors: (1) common ownership; (2) financial independence;

2

In local parlance, this strategy would be called “sandbagging.”
10

(3) degree of selection of executive personnel and failure to observe corporate
formalities; and (4) the degree of control over marketing and operational policies.
Builder Mart of America, Inc. v. First Union Corp., 563 S.E.2d 352, 358 (S.C. Ct. App.
2002), overruled on other grounds by Farmer v. Monsanto Corp., 579 S.E.2d 325 (S.C.
2003). “For the courts to have personal jurisdiction” under this theory, the plaintiff “must
show that the subsidiary functions as the agent or mere department of the parent—that is,
that the subsidiary does all the business which the parent corporation could do if here on
its own.” Id. “It is essential that all four factors be present with sufficient factual
specificity to confer jurisdiction on [ ] courts.” Id.
Plaintiffs argue in their response brief that WBA is the alter ego of Walgreen Co.
because WBA identifies its Retail Pharmacy USA operations as a “division” of WBA,
and Walgreen Co. is the WBA subsidiary that conducts the Retail Pharmacy USA
operations. Plaintiffs explain that in WBA’s most recent 10-K filing, WBA touts itself as
“a market leader in the United States” that operates 9,560 retail stores within its Retail
Pharmacy USA division and holds pharmacy licenses. ECF No. 143-1 at 8, 13, 34.
Plaintiffs also argue that WBA and Walgreen Co. share the same principal place of
business and that WBA guarantees Walgreen Co.’s debt and matches employee
contributions to Walgreen Co.’s profit-sharing retirement plan, all of which indicate
WBA’s alter ego status. Am. Compl. ¶¶ 11, 14; ECF No. 143-1 at 92 n.4, 107.
The additional exhibits submitted by plaintiffs include press releases, personnel
biographies from WBA’s website, and a settlement stipulation order. There is a
December 31, 2014 press release announcing that Walgreen Co. and Alliance Boots
GmbH completed Step 2 of their merger to form WBA; a December 10, 2014 press

11

release announcing that the Walgreen Co. president and chief executive officer would
retire once the merger between Walgreen Co. and Alliance Boots was complete and that
the Walgreen Co. Chariman would become WBA’s executive chairman; a June 9, 2016
press release announcing various changes in senior management following the Walgreen
Co. and Alliance Boots merger; and a February 3, 2020 press release announcing changes
to WBA’s IT system. ECF Nos. 154-1, 154-3, 154-4, 154-9. Plaintiffs also include
biographies of various WBA executives who currently hold or have held positions at both
WBA and Walgreen Co. ECF No. 154-2, 154-5, 154-6, 154-7. Finally, plaintiffs
include a December 20, 2018 settlement stipulation and order from the Southern District
of New York to which WBA is a party to show that WBA admitted to conduct related to
IntercomPlus and that Walgreen Co.’s general counsel signed the agreement. ECF No.
154-8.
This evidence is insufficient to show that WBA exercises the degree of control
over Walgreen Co. such that WBA is its alter ego. The facts cited by plaintiffs simply
show that Walgreen Co. is a subsidiary of WBA that operates a division of WBA. This
court has previously held that a parent company referring to “its subsidiary companies by
the informal title of ‘division’ rather than emphasizing these are distinct corporate entities
does not give rise to jurisdiction.” Wright v. Waste Pro USA Inc., 2019 WL 3344040, at
*7 (D.S.C. July 25, 2019). With regard to financial independence, WBA guaranteeing
Walgreen Co.’s debt is not significant because “little, if any control, is exemplified by [a
parent company]’s serving as a guarantor to its subsidiary.” ScanSource, Inc. v. Mitel
Networks Corp., 2011 WL 2550719, at *6 (D.S.C. June 24, 2011). Similarly, the court

12

fails to see how WBA’s contribution to Walgreen Co.’s profit-sharing retirement plan
shows Walgreen Co.’s lack of financial independence.
Plaintiffs provide no evidence to suggest that WBA and Walgreen Co. fail to
observe corporate formalities. This alone is fatal to their argument. Builder Mart of
Am., Inc., 563 S.E.2d at 358 (“It is essential that all four factors be present with sufficient
factual specificity to confer jurisdiction.”). As to the degree of common executive
personnel, the fact that WBA executives previously worked for Walgreen Co. is of no
import to the alter ego analysis, especially since Walgreen Co. and Alliance Boots
merged to form a new company, WBA. All of the press releases cited by plaintiffs show
as much. Along similar lines, the fact that WBA admitted to conduct related to
IntercomPlus and the fact that Walgreen Co.’s general counsel signed the settlement
stipulation do not convince the court that WBA operates as an alter ego to Walgreen Co.
but instead merely suggests that WBA took legal responsibility for conduct of its
subsidiary.
Finally, plaintiffs argue that WBA and Walgreen Co. share a principal place of
business and “WBA and Walgreen Co. jointly conduct business through South Carolina
under the ‘Walgreens’ trade name,” ECF No. 143 at 38, but “unified marketing and
advertising and holding out to the public as a single entity, without more, insufficient to
confer jurisdiction,” Builder Mart of Am., Inc., 563 S.E.2d at 358–59. As such, plaintiffs
have failed to show that WBA is the alter ego of Walgreen Co., meaning the court does
not have personal jurisdiction over WBA.
Plaintiffs requested for the first time at the hearing that the court permit
jurisdictional discovery. The court declines to entertain this belated request. Therefore,

13

the court dismisses WBA from this case, leaving Walgreen Co. as the only remaining
defendant. As such, the court will only refer to Walgreen Co. moving forward.
B. Motion to Dismiss for Failure to State a Claim
Next, Walgreen Co. presents various arguments as to why each of plaintiffs’
claims should be dismissed. As an initial matter, Walgreen Co. argues that plaintiffs’
FCRA claim should be dismissed for a variety of reasons, including the fact that
Walgreen Co. is not a consumer reporting agency, Walgreen Co. does not receive
plaintiffs’ PII from a consumer reporting agency, plaintiffs’ PII is not a “consumer
report,” and the FCRA explicitly excludes plaintiffs’ PII from the definition of a
“consumer report.” Plaintiffs appeared to care so little about this claim that they failed to
mention it in their response brief. When asked at the hearing if they had abandoned their
claim, plaintiffs’ counsel said that they did not and that they failed to address the claim in
their response brief because of the page limit but planned to do so at the hearing. Local
Rule 7.05 requires memoranda to include “[t]he argument . . . relating to the matter
before the court for ruling with appropriate citations,” Local Civ. Rule 7.05(a)(3)
(D.S.C.), and failure to address a claim in an opposition memorandum constitutes waiver
of that claim. Jones v. Family Health Ctr., Inc., 323 F. Supp. 2d 681, 690 (D.S.C. 2003),
aff’d 98 F. App’x 959 (4th Cir. 2004). Moreover, the court notes that Walgreens was
able to present arguments on all of plaintiffs’ claims within the same page limit provided
to plaintiffs and that plaintiffs had the option to ask for leave to file excess pages if they
ran out of room in their brief. In light of these considerations, the court finds that
plaintiffs abandoned the FCRA claim and dismisses it. The same is true for plaintiffs’

14

negligence per se claim based on an alleged violation of FCRA. The court now turns to
plaintiffs’ other causes of action.
a. Invasion of Privacy: Wrongful Appropriation
Walgreen Co. argues that plaintiffs’ wrongful appropriation claim must be
dismissed because plaintiffs fail to allege: (1) that Walgreen Co. publicized their names
or identities; (2) any appropriation of the commercial value of their names, identities,
appearances, or personalities; and (3) a factual basis that Walgreen Co. processed
plaintiffs’ PII without their consent. Plaintiffs take issue with each of these points,
arguing that publicity is not required for wrongful appropriation, that wrongful
appropriation is not limited to commercial value, and that they did not consent to
Walgreen Co.’s use of their PII. The court dismisses this claim based on plaintiffs’
failure to allege publicity and therefore declines to address the other two arguments.
“In South Carolina, there are three separate and distinct causes of action for
invasion of privacy: 1) wrongful appropriation of personality; 2) wrongful publicizing of
private affairs; and 3) wrongful intrusion into private affairs.” Sloan v. S.C. Dep’t of
Pub. Safety, 586 S.E.2d 108, 110 (S.C. 2003). “Encompassed in these three recognized
torts is the infringement on the right of publicity; it is denominated wrongful
appropriation of personality.” Gignilliat v. Gignilliat, Savitz & Bettis, L.L.P., 684 S.E.2d
756, 760 (S.C. 2009). Plaintiffs argue that Gignilliat identifies the elements of wrongful
appropriation of personality as: (1) the unconsented use of the plaintiff’s name, likeness,
or identity; (2) by the defendant; and (3) for the defendant’s own benefit; and that
publicity is not a required element. The Gignilliat court does discuss those elements in
defining the cause of action, stating that “[w]rongful appropriation of personality

15

involves the intentional, unconsented use of the plaintiff’s name, likeness, or identity by
the defendant for his own benefit.” 684 S.E.2d at 759 (quoting Sloan v. South Carolina
Dep’t of Pub. Safety, 586 S.E.2d 108, 110 (S.C. 2003)). However, in the very next
sentence, the court states that “[t]he gist of the action is the violation of the plaintiff’s
exclusive right at common law to publicize and profit from his name, likeness, and other
aspects of personal identity.” Id. (emphasis added) (quoting Sloan, 586 S.E.2d at 110).
This and other discussions by South Carolina courts make clear that while
publicity is not explicitly stated as an element per se, it is still a fundamental requirement
of the cause of action of wrongful appropriation of personality. As South Carolina courts
have recognized, “[t]he terms ‘infringement on the right of publicity’ and ‘wrongful
appropriation of personality’ are interchangeable.” In re Wiser, 2010 WL 5437241, at *6
(Bankr. D.S.C. June 21, 2010); see also Uhlig LLC v. Shirley, 2011 WL 1119548, at *7
(D.S.C. Mar. 25, 2011) (“The South Carolina Supreme Court has stated that ‘wrongful
appropriation of personality’ and ‘infringement on the right of publicity’ are the same
claim under the rubric of ‘invasion of privacy.’”). Indeed, Gignilliat explained that
“[e]ncompassed in [wrongful appropriation of personality, wrongful publicizing of
private affairs, and wrongful intrusion of private affairs] is the infringement on the right
of publicity.” 684 S.E.2d at 760. Moreover, in Holloman v. Life Ins. Co. of Va., the
plaintiff argued that the defendant violated her right to privacy when the defendant issued
a life insurance policy to her son without the plaintiff’s consent, and the Supreme Court
of South Carolina held that the plaintiff’s claim failed because the issuance of a life
insurance policy did not publicize her name. 7 S.E.2d 169, 171 (S.C. 1940) (Mem.). As
such, infringement on the right of publicity and wrongful appropriation of personality are

16

one in the same, meaning publicity is required in a wrongful appropriation of personality
claim.3
Plaintiffs argue that Holloman is inapplicable because it was decided prior to
Gignilliat’s expression of the current state of the law and that the Supreme Court of South
Carolina’s statement in Sloan that “[t]he gist of [wrongful appropriation of personality] is
the violation of the plaintiff’s exclusive right at common law to publicize and profit from
his name, likeness, and other aspects of personal identity,” 586 S.E.2d at 110, is a
“colloquial description” that “cannot alter the South Carolina Supreme Court’s express
wrongful appropriation formulation.” ECF No. 143 at 8. However, plaintiffs fail to cite
to any South Carolina case discussing wrongful appropriation of personality that does not
involve publicity. Instead, the cases that rely on Gignilliat involve some form of
publicity. See Ins. Prod. Mktg., Inc. v. Conseco Life Ins. Co., 2012 WL 3308368, at *5
(D.S.C. Aug. 13, 2012) (genuine issue of material fact as to whether the defendant’s use
of plaintiffs’ name on its correspondence was wrongful appropriation); In re Wiser, 2010
WL 5437241, at *7 (granting summary judgment on debtors’ wrongful appropriation
claim because there was no publicizing of debtors’ names). Plaintiffs cite to a law review
article by Professor William Prosser that states that appropriation does not depend upon
publicity, but they do not cite to any authority to suggest that this view has been adopted
by any South Carolina court, which is the relevant inquiry here.
Plaintiffs also argue, in a footnote, that if wrongful appropriation requires
publicity, plaintiffs have alleged that Walgreen Co. publicized their information by

3

As discussed below, plaintiffs disagree with this conclusion and unsuccessfully
attempt to distinguish the two causes of action.
17

transferring it from the pharmacy to the EDW database, which is “used as an information
highway for other corporate-wide, non-pharmacy business units (including 340B
Complete) to access.” ECF No. 143 at 8 n.2. Even accepting as true the factual
allegation that non-pharmacy Walgreen Co. employees can access EDW and plaintiffs’
PII, the court fails to see how this access constitutes publicity as a matter of law. As
discussed in greater detail below, the Restatement (Second) of Torts, which has been
adopted by the Supreme Court of South Carolina, has defined publicity as making the
matter public “by communicating it to the public at large, or to so many persons that the
matter must be regarded as substantially certain to become one of public knowledge.”
Swinton Creek Nursery v. Edisto Farm Credit, ACA, 514 S.E.2d 126, 132 (S.C. 1999).
The fact that Walgreen Co. employees can access plaintiffs’ PII does not mean that
plaintiffs’ PII is being communicated to the public at large. Because plaintiffs have not
sufficiently alleged that Walgreen Co. is publicizing plaintiffs’ PII to the public at large,
their cause of action for wrongful appropriation must fail.
b. Invasion of Privacy: Wrongful Publicizing of Private Affairs
Next, Walgreen Co. argues that plaintiffs’ wrongful publicizing of private affairs
claim fails because, like in their wrongful appropriation claim, plaintiffs fail to allege that
Walgreen Co. publicized their PII. “Wrongful publicizing of private affairs involves a
public disclosure of private facts about the plaintiff . . . in which there is no legitimate
public interest.” Snakenberg v. Hartford Cas. Ins. Co., 383 S.E.2d 2, 6 (S.C. Ct. App.
1989). “The gravamen of the tort is publicity as opposed to mere publication.” Id. The
Supreme Court of South Carolina, relying on the Restatement (Second) of Torts, has
distinguished these terms, explaining that “publication” is “any communication by the

18

defendant to a third person” while “‘[p]ublicity . . . means that the matter is made public,
by communicating it to the public at large, or to so many persons that the matter must be
regarded as substantially certain to become one of public knowledge.” Swinton Creek
Nursery, 514 S.E.2d at 132. However, the size of the audience alone is not determinative
of whether a communication is publication or publicity, as publicity can include “any
publication in a newspaper or a magazine, even of small circulation, or in a handbill
distributed to a large number of persons, or any broadcast over the radio, or statement
made in an address to a large audience.” Id. Instead, the distinction “is one between
private and public communication.” Id.
Plaintiffs allege that their PII is transferred from IntercomPlus to EDW, which “is
not a secure platform for pharmacy customers’ PII because unauthorized persons and
other Walgreens’ departments, divisions, and/or units can and do unlawfully access
pharmacy customers’ PII contained therein.” Am. Compl. ¶¶ 68–69 (emphasis added).
Plaintiffs further allege that the 160 non-pharmacy employees in the 340B Complete
division of Walgreen Co. have unauthorized access to plaintiffs’ PII in EDW. Id. ¶¶ 76–
78. Plaintiffs argue that this constitutes publicity, equating this alleged unauthorized
access by 160 employees to “small [newspaper] circulation,” “a large number of
persons,” or a “large audience.” ECF No. 143 at 11. However, plaintiffs’ focus on the
number of people is misplaced. As the Supreme Court of South Carolina has made clear,
the relevant distinction between publication and publicity has to do with private versus
public communication, not the size of the audience. A “small [newspaper] circulation,”
“a handbill distributed to a large number of persons,” and a “statement made in an
address to a large audience” are all instances of communication that is dispersed to the

19

general public. Here, plaintiffs do not allege that plaintiffs’ PII is communicated publicly
or made public in any manner. Accepting plaintiffs’ allegations as true, just because
plaintiffs’ PII may be accessed within Walgreen Co. by Walgreen Co. employees does
not mean it is distributed or made available to the public, which is a requirement of
wrongful publicizing of private affairs claim. Therefore, the court dismisses this claim.
c. Negligence Per Se Based on HIPAA, FCRA, and FTCA
Walgreen Co. contends that plaintiffs’ negligence per se claim based on violations
of HIPAA, FCRA, and FTCA must fail. As discussed above, the court has found that
plaintiffs abandoned any arguments about the FCRA, meaning the court will only focus
on negligence per se for violations of HIPAA and FTCA. Walgreen Co. argues that this
claim should be dismissed because plaintiffs cannot maintain a negligence per se claim
based on a statutory violation unless the statute permits a private cause of action, and
neither HIPAA nor FTCA do. Walgreen Co. then argues that even if HIPAA and FTCA
were to permit a private cause of action, plaintiffs have failed to allege a violation of
either statute.
i. Private Cause of Action
First, Walgreen Co. argues that plaintiffs’ negligence per se claim must fail
because neither HIPAA nor the FTCA permit a private cause of action. In response,
plaintiffs argue that while HIPAA and the FTCA do not explicitly contain a private cause
of action, the statutes imply a cause of action, meaning they have properly alleged their
claim.
“A statute must permit a private cause of action in order for plaintiffs to maintain
a civil suit” for negligence per se. Salley v. Heartland-Charleston of Hanahan, SC, LLC,

20

2011 WL 2728051, at *3 (D.S.C. July 12, 2011). However, that private cause of action
need not be explicit. “When a statute does not specifically create a private cause of
action, one can be implied only if the legislation was enacted for the special benefit of a
private party.” Doe v. Marion, 645 S.E.2d 245, 248 (S.C. 2007); see also Companion
Prop. & Cas. Ins. Co. v. U.S. Bank Nat’l Ass’n, 2016 WL 3027552, at *8 (D.S.C. May
27, 2016) (“In the context of negligence per se, the primary factor to determine whether a
statute creates such a primary right is legislative intent, which ‘is determined primarily
from the language of the statute.” (internal quotations omitted)). As such, “for a statute
to support a claim for negligence per se, a plaintiff must show that the statute was enacted
for the special benefit of a private party.” Winley v. Int’l Paper Co., 2012 WL 13047989,
at *10 (D.S.C. Oct. 23, 2012) (internal quotations omitted). In contrast, “[i]f a statute is
concerned with the protection of the public and not with the protection of an individual’s
private right, it cannot support a private cause of action for negligence per se.” Id. Stated
differently, a statute may form the basis of a negligence per se claim when “(1) the
essential purpose of the statute is to protect from the kind of harm the plaintiff has
suffered; and (2) the plaintiff is a member of the class of persons the statute is intended to
protect.” Whitlaw v. Kroger Co., 410 S.E.2d 251, 252 (S.C. 1991).
Therefore, the question becomes whether plaintiffs have adequately pleaded that
the essential purpose of HIPAA and the FTCA is to protect from the kind of harm
plaintiffs have allegedly suffered and whether plaintiffs are members of the class meant
to be protected by the statutes. However, the problem is that plaintiffs have not pleaded
this at all. They argued in their response brief and at the hearing that these two prongs
exist, but “[i]t is well-established that parties cannot amend their complaints through

21

briefing or oral advocacy.” S. Walk at Broadlands Homeowner’s Ass’n, Inc. v.
OpenBand at Broadlands, LLC, 713 F.3d 175, 184 (4th Cir. 2013). Nowhere in their
complaint do plaintiffs allege that they are members of the class that HIPAA and the
FTCA are meant to protect or that HIPAA and the FTCA are meant to protect from the
harm plaintiffs have allegedly suffered.4
Moreover, even if plaintiffs had included these allegations in their amended
complaint, the court is not convinced that HIPAA implies a private cause of action such
that it can form the basis of a negligence per se claim as a matter of law. Plaintiffs argue
that “[c]ourts have held that HIPAA, while not providing a private cause of action, may
be a legitimate element of a state law claim and have allowed negligence per se claims to
stand,” citing to various cases. ECF No. 143 at 19 n.4. However, several of those cases
permit the use of HIPAA to inform the standard of care in an ordinary negligence claim,
not the use of a HIPAA violation as the basis of a negligence per se claim, and the rest
are clearly inapplicable.5 See Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C.,

4

In their response brief, plaintiffs claim that they alleged these elements with
regard to the FTCA, citing to several paragraphs of the amended complaint. However,
plaintiffs only cite to an allegation that “Walgreens is covered by the mandates of the
FTCA, which prohibits unfair and deceptive conduct affecting commerce, a law that has
been enforced and interpreted to include a company’s information privacy practices,”
Am. Compl. ¶ 119, and conclusory allegations that Walgreen Co. violated the FTCA, id.
¶¶ 169–74.
5
It is not clear why plaintiffs cited to Merrell Dow Pharma. Inc. v. Thompson,
478 U.S. 804 (1986), as it contains no mention of HIPAA. In Citizens Bank of
Pennsylvania v. Reimbursement Techs., Inc., the court assumed arguendo that a HIPAA
violation could be used as the basis of a negligence per se claim and found that the
plaintiff failed to relate the defendant’s alleged statutory violation to the plaintiff’s
injuries. 2014 WL 2738220, at *5 (E.D. Pa. June 17, 2014), aff’d, 609 F. App’x 88 (3d
Cir. 2015). This means the court did not actually find that a HIPAA violation could form
the basis of a negligence per se claim but the court assumed for sake of argument that it
could to show that the plaintiff’s claim failed on the proximate cause element. In I.S. v.
Washington Univ., the court did not consider the merits of whether HIPAA could be used
22

102 A.3d 32, 47 (Conn. 2014) (noting that “several [courts] have determined that HIPAA
may inform the relevant standard of care”); Acosta v. Byrum, 638 S.E.2d 246, 251 (N.C.
Ct. App. 2006) (finding that the plaintiff sufficiently pleaded the standard of care in her
negligence claim because she alleged that HIPAA establishes the standard of care); FungSchwartz v. Cerner Corp., 2018 WL 4386087, at *8 (S.D.N.Y. Sept. 13, 2018) (finding
that HIPAA can be used to establish standard of care in a negligence claim).
There is a difference between using a statute to establish the standard of care in an
ordinary negligence claim and using the violation of a statute to establish the duty and
breach of duty in a negligence per se claim. Negligence per se uses a statutory violation
to establish duty and breach of duty. Rayfield v. S.C. Dep’t of Corr., 374 S.E.2d 910,
914–15 (S.C. Ct. App. 1988). In contrast, if a statute is used to established a standard of
care, there must be some independent duty because “[o]nly when there is a duty would a
standard of care need to be established.” Doe ex rel. Doe v. Wal-Mart Stores, Inc., 711
S.E.2d 908, 912 (S.C. 2011). In other words, there must be some duty, i.e., a common
law duty of confidentiality, that exists before looking to HIPAA to inform the standard of
care. Indeed, plaintiffs cite to no case in which a court permitted a negligence per se
claim based on a violation of HIPAA, and the court’s own research has revealed none.
Therefore, there appears to be no basis in the law that a violation of HIPAA can be used
to plead a negligence per se claim.

to establish a negligence per se claim but instead addressed the issue of whether such a
claim gives rise to federal question jurisdiction. 2011 WL 2433585, at *3 (E.D. Mo. June
14, 2011). The same is true in Graves v. Health Exp., Inc., 2009 WL 2835778, at *3
(W.D. La. Aug. 31, 2009).
23

With regard to the FTCA, Plaintiffs cite to various cases in which courts have
found an implied cause of action in the FTCA, meaning a violation of the FTCA could
serve as the basis for a negligence per se claim. See In re Equifax, Inc., Customer Data
Sec. Breach Litig., 362 F. Supp. 3d 1295, 1327 (N.D. Ga. 2019) (denying motion to
dismiss the plaintiffs’ negligence per se claim based on a violation of the FTCA because
the complaint adequately pleaded a violation of the FTCA, that the plaintiffs were within
the class of persons that the statute intended to protect, and that the harm suffered is the
kind that the statute meant to protect); Bans Pasta, LLC v. Mirko Franchising, LLC, 2014
WL 637762, at *13 (W.D. Va. Feb. 12, 2014) (same). Assuming arguendo that plaintiffs
properly alleged this cause of action and that a violation of the FTCA could serve as the
basis of a negligence per se claim, the court finds that plaintiffs have failed to sufficiently
allege a FTCA violation.
The FTCA prohibits “unfair or deceptive acts or practices in or affecting
commerce,” 15 U.S.C. § 45(a), and plaintiffs allege that Walgreen Co.’s failure to
maintain reasonable and appropriate data security for plaintiffs’ PII constitutes an unfair
method of competition in commerce, Am. Compl. ¶ 173. Plaintiffs rely on case law that
has interpreted the FTCA to apply to instances in which an entity has insufficient
cybersecurity. For example, in a case cited by plaintiffs, the Third Circuit considered
whether the defendant’s failure to use certain cybersecurity measures to prevent hackers
from accessing consumers’ information violated the FTCA. F.T.C. v. Wyndham
Worldwide Corp., 799 F.3d 236, 242 (3d Cir. 2015). Similarly, in the other case cited by
plaintiffs, there were factual allegations of hackers accessing consumers’ personal
information due to Equifax’s weak cybersecurity practices. In re Equifax, Inc., Customer

24

Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1310 (N.D. Ga. 2019). Notably, these
cases both involve third-party hackers gaining access to a company’s information due to
inadequate cybersecurity protections.
Here, plaintiffs allege that “Walgreens’ EDW is not a secure platform for
pharmacy customers’ PII because unauthorized persons and other Walgreens’
departments, divisions, and/or units can and do unlawfully access pharmacy customers’
PII contained therein.” Am. Compl. ¶ 69. Plaintiffs do not allege that Walgreen Co.’s
cybersecurity practices are inadequate nor do they allege any attempt by a third-party
hacker to access plaintiffs’ PII. In other words, plaintiffs do not factually allege the type
of FTCA violation upon which they purport to base their claim. As such, plaintiffs’
negligence per se claim based on violations of federal law must be dismissed.
d. Negligence Per Se Based on PIPA
Next, Walgreen Co. argues that plaintiff’s negligence per se claim based on a
violation of PIPA must be dismissed because PIPA does not create a private cause of
action, PIPA only limits external transfers of information, PIPA’s exceptions cover the
actions that plaintiffs challenge, and PIPA’s prohibition of disclosing PII does not apply
because Walgreens does not disclose such information. Plaintiffs disagree with all of
these arguments.
i. Private Cause of Action
First, Walgreen Co. argues that PIPA does not create a private cause of action and
can only be enforced through criminal prosecution or agency action. In response,
plaintiffs argue that PIPA implies a private cause of action. Unlike their negligence per
se claim based on violations of federal law, plaintiffs did allege that the purpose of PIPA

25

was to protect from unauthorized use of PII and that plaintiffs fall within the class of
person that PIPA is meant to protect, Am. Compl. ¶¶ 183–84, and they argue as much in
their response brief.
As Walgreen Co. points out, neither party cites to any case that recognizes a
private cause of action in PIPA. The court has also been unable to locate any instance in
which a court has held that a violation of PIPA could be used to imply a cause of action
such that a negligence per se claim could be sustained. Nevertheless, plaintiffs have
alleged that the two requirements of negligence per se exist here, and Walgreen Co.
provides no argument in opposition to those allegations. As such, the lack of an explicit
private cause of action does not convince the court that this claim should be dismissed.
ii. External Transfers
Next, Walgreen Co. argues that plaintiffs failed to allege a violation of PIPA
because PIPA only applies to external transfers, and any use of plaintiffs’ PII is internal
to Walgreens. In response, plaintiffs argue that PIPA simply prohibits any transfer of PII
outside of the database in which it was entered with patients’ consent, and that defendants
alter the plain language of PIPA by inserting the modifier “external” before the word
“transfers.”
PIPA states that “[n]o patient prescription drug information may be transferred or
received by a person without the written consent of the patient or a person authorized by
law to act on behalf of the patient.” S.C. Code Ann. § 44-117-30. “Patient prescription
drug information” is defined in relevant part as “any data concerning the dispensing of a
drug or device that identifies a patient as having been the recipient of a prescription drug

26

or device, whether this data is held by a practitioner, pharmacy, or another entity.” Id.
§ 44-117-20. The statute then lists various exceptions to this prohibition.
Walgreen Co. argues that this prohibition only applies to external data transfers,
and because any transfer of data here occurs within the Walgreen Co. entity, plaintiffs
have failed to allege a violation of PIPA. In response, plaintiffs argue that PIPA prohibits
any transfer of PII outside of the pharmacy setting without written consent of the patient.
Plaintiffs argue that this distinction between external and internal transfers is without
merit. They contend that plain language of the statute states that “[n]o patient
prescription drug information may be transferred or received by a person without the
written consent of the patient,” S.C. Code Ann. § 44-117-30, and that the plain meaning
of “transfer” is “to convey from one person, place, or situation to another.” As such,
plaintiffs contend that any transfer outside of the pharmacy itself, whether within
Walgreen Co. or not, without consent is prohibited by PIPA, and that any reading of
PIPA that would permit a corporation that owns pharmacies to control pharmacy data is
absurd.6

6

This argument is somewhat puzzling since plaintiffs stated on more than one
occasion that they do not object to the initial data transfer from IntercomPlus to EDW,
which would be prohibited under their interpretation of PIPA. See ECF No. 98,
Preliminary Injunction Hearing Day 2 Tr. 84:6–10 (“The backup from the IntercomPlus
system, the actual data system into the secondary server for us is not objection as long as
it’s not used for any other purpose. What happens though, and I think the evidence has
been very clear, is that the 340B Complete program reaches sort of through a back door
into EDW and scans that data.”); id. 81:25–82:7 (The Court: “Well, you don’t have any
problem with sending to the Enterprise Data Warehouse, because that’s kind of the
backup.” Mr. Moore: “No, that’s just the backup.” The Court: “Your problem is taking
the Enterprise Data and running it through 340B Complete.” Mr. Moore: “Right. It
reaches in, messes around, and it pulls it out.”).
27

However, the statute prohibits the “transfer[ ] or recei[pt] by a person.” Based
on plaintiffs’ own allegations, that is not what occurs here. Instead, plaintiffs allege that
PIPA prohibits Walgreen Co.’s “transfer” of plaintiffs’ PII “from its pharmacy’s
IntercomPlus system to its corporate EDW repository” and Walgreen Co.’s “receipt” of
plaintiffs’ PII “by its 340B Complete software and/or process from its corporate EDW
repository.” Am. Compl. ¶¶ 187–88. These are not instances of transfers or receipts by a
person. Instead, they are instances of transfer and receipts by databases within the same
entity, Walgreen Co. Moreover, as Walgreen Co. points out, if “transfer” was to be
interpreted as narrowly as plaintiffs claim, i.e., any conveyance of information outside of
the four walls of the pharmacy, then PIPA would prohibit basic functions such as
transmitting information for legal, administrative, or IT services that do not occur within
the four walls of the pharmacy.
The court previously interpreted the statute to prohibit external transfers of
information to another entity relying in part on PIPA’s exceptions. 7 Most of PIPA’s
exceptions to the prohibition of transfers that are enumerated in § 44-117-30 relate to
external transfers of patient prescription drug information. Those include transmittals of
a prescription drug order, id. § 44-117-30(1); communications with other health care
professionals who treat the patient, id. § 44-117- 30(2); information necessary to effect
the recall of a defective drug, id. § 44-117-30(4); information necessary to adjudicate or
process payment claims, id. § 44-117-30(6); and information for use in clinical research

7

The court acknowledges that its findings of fact and conclusions of law in its
order denying the preliminary injunction are not binding. However, many of the issues
that the court considered in that order were purely legal in nature, like its interpretation of
PIPA, and absent an argument convincing it otherwise, the court stands by its previous
legal analysis.
28

and medical studies, id. § 44-117-30(8)–(9). It stands to reason that if the prohibition
applied to external transfers, then the exceptions to the prohibition would include external
transfers. Moreover, PIPA clarifies that it does not invalidate other certain laws and
authority, including the authority of a court to subpoena patient prescription drug
information, the authority of a licensing or disciplinary board of the State to obtain
prescription records, and the authority of the Department of Health and Environmental
Control to access the records. Id. § 44-117-50. These are all authorities to which
information would be transferred externally outside of the entity that holds the patient’s
PII. Based on this context, the court is still convinced that PIPA does not prohibit what
plaintiffs allege here—transfer of data within the same entity.
Plaintiffs cite to several portions of PIPA that they argue requires patient
information to stay within the pharmacy context. They first cite to a portion of the statute
that requires that “[a]ll electronic equipment for receipt of prescription drug orders
communicated by way of electronic transmission must have adequate security and system
safeguards and must be maintained so as to ensure patient confidentiality and to ensure
against unauthorized access or an intervening person or entity having access to view,
read, manipulate, alter, store, or delete the electronic prescription prior to its receipt by
the pharmacy of the patient’s choice.” S.C. Code Ann. § 44-117-330 (emphasis added).
However, the court understands this to stand for the proposition that a pharmacy needs
security measures to make sure no one can intercept patient information prior to the
pharmacist receiving it.
Next, plaintiffs cite to S.C. Code Ann. § 44-117-340(F), which requires that “[t]he
facsimile machine receiving prescription drug orders must be in the prescription

29

department of the pharmacy to protect confidentiality and security.” This provision does
suggest that patient information must be kept within the pharmacy setting, as it
presumably prevents a fax machine set up in, for example, the photo department from
receiving prescription information. However, the court is unconvinced that this provision
alone prohibits transfer of PII within the same entity. S.C. Code Ann. § 44-117-350(b)
requires pharmacies “provide a mechanism to prevent the disclosure of any information,
confidential or otherwise, about patients that was obtained or collected by a pharmacist or
pharmacy incidental to the delivery of pharmaceutical care other than as authorized in
regulation.” The court fails to see how this requirement factors into the internal/external
debate. Finally, plaintiffs point to S.C. Code Ann. § 44-117-350(c), which requires the
pharmacist-in-charge to “establish and maintain written policies and procedures for
maintaining the integrity and confidentiality of prescription information and patient
health care information” and requires “[a]ll employees of the pharmacy with access to
this information . . . to comply with the established policies and procedures.” Again, the
court is not sure how this citation plays into the internal/external distinction.
In light of these arguments, the court is unconvinced that plaintiffs have
sufficiently alleged a violation of PIPA. Plaintiffs allege that data is transferred between
databases that are all within Walgreen Co., and the court finds no support in the language
of PIPA for plaintiffs’ narrow interpretation that PIPA prohibits data transfer outside of
the pharmacy setting. As such, the court dismisses the claim.
e. Breach of Contract
Plaintiffs bring a claim for breach of contract in their amended complaint for
Walgreen Co.’s alleged breach of the “terms of an implied contract, insurance

30

agreements, and privacy policies” to “properly maintain and store their PII and to not
transfer, receive, and/or use, disclose, or disseminate it in furtherance of its 340B
Complete process(es).” Am. Compl. ¶¶ 195–96. Walgreen Co. argues that the claim
should be dismissed because plaintiffs fail to identify the terms of any implied contract
between Walgreen Co. and plaintiffs.
“A contract is an obligation which arises from actual agreement of the parties
manifested by words, oral or written, or by conduct.” Stanley Smith & Sons v.
Limestone Coll., 322 S.E.2d 474, 477 (S.C. Ct. App. 1984). If an agreement is
manifested by conduct, then the contract is implied. Id. “An implied contract, like an
express contract, rests on an actual agreement of the parties to be bound to a particular
undertaking. The parties must manifest their mutual assent to all essential terms of the
contract in order for an enforceable obligation to exist.” Id. Plaintiffs allege that
Walgreen Co. implicitly agreed to maintain and store plaintiffs’ PII confidentially and to
not transfer and/or use that information for 340B Complete without plaintiffs’ consent,
and in exchange, plaintiffs purchased medication from the pharmacies. However,
plaintiffs have failed to allege that they even knew of, much less agreed to, one of the
essential terms of the purported implied contract—that Walgreen Co. would not use their
PII for the purposes of 340B Complete. In fact, plaintiffs allege just the opposite by
claiming that “Walgreens pharmacy customers do not consent to, are unaware of, and
have no reason to expect Walgreens’ surreptitious transfer, receipt, and/or use, disclosure,
or dissemination of their PII following the completion of their retail pharmacy
transaction.” Am. Compl. ¶ 86. If plaintiffs were unaware of the alleged use of their PII
during 340B Complete, then the court fails to see how they could have entered into an

31

implied contract with Walgreen Co. that included a term that Walgreen Co. would not use
their PII in such a manner.
In addition, plaintiffs allege that Walgreen Co.’s use of plaintiffs’ PII violates
Walgreen Co.’s insurance agreements and Walgreen Co.’s Notice of Privacy Practices
(“NPP”). Beginning with the “insurance agreements,” plaintiffs argue that Walgreen Co.
pharmacies “agree to provide pharmaceutical care and services to Plaintiffs in return for
claim reimbursement by Plaintiffs’ insurers.” ECF No. 143 at 23. Counsel expanded on
this at the hearing, arguing that insurers pay Walgreen Co. on the premise that the
patient’s information is kept confidential and as a benefit to the patient, creating an
agreement between the parties. However, plaintiffs fail to allege any terms of these
insurance agreements nor do they provide any argument as to how they have standing to
raise a claim for breaching these supposed agreements when the agreements allegedly
exist between insurance companies and Walgreen Co., not between Walgreen Co. and
plaintiffs.
With regard to the NPPs, as another court has explained, NPPs “are not
contractual in nature” but instead “inform patients of their rights under federal law—
specifically [HIPAA]—and the duties imposed . . . by these statutory provisions.” Brush
v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1367 (S.D. Fla. 2017). As
such, NPPs cannot create contractual obligations because entities like Walgreen Co. are
required by law to comply with HIPAA without receiving consideration from plaintiffs.
Therefore, plaintiffs have failed to allege all three contracts upon which they base their
breach of contract claim, and the court dismisses the claim.

32

f. Negligence Based on Professional Standards
Next, Walgreen Co. contends that plaintiffs’ negligence claim based on breach of
duties established by professional standards must be dismissed. First, Walgreen Co.
argues that plaintiffs fail to identify any duty of care that Walgreen Co. has breached.
Plaintiffs allege that “Walgreens breached its duty to Plaintiffs and Class Members by
failing to conform to the privacy practices universally recognized and accepted in the
pharmaceutical profession.” Am. Compl. ¶ 211. Plaintiffs allege that those privacy
practices are prescribed by the South Carolina Board of Pharmacy, the American
Pharmaceutical Association Code of Ethics, and PIPA. Id. ¶ 209. PIPA is discussed in
plaintiffs’ negligence per se claim, but plaintiffs fail to cite to any portion of the
American Pharmaceutical Association Code of Ethics or standard prescribed by the South
Carolina Board of Pharmacy that establishes a duty. In response, plaintiffs argue that
Walgreen Co. has a duty to exercise reasonable care when its actions create a risk to
others and cites to several cases that plaintiffs argue recognize such a duty in this context,
none of which is a South Carolina case. Plaintiffs also argue that they have sufficiently
alleged the duties prescribed by the South Carolina Board of Pharmacy that require
Walgreen Co. to protect pharmacy customers’ PII, which are promulgated in the PPA.
Am. Compl. ¶ 221.
Plaintiffs fail to cite to any source of Walgreen Co.’s purported duty to “conform
to the privacy practices universally recognized and accepted in the pharmaceutical
profession.” While plaintiffs contend that the duty prescribed by the South Carolina
Board of Pharmacy is promulgated in the PPA, plaintiffs bring a separate negligence
cause of action based on the PPA, and the paragraph that they cite to, ¶ 221, is within that

33

cause of action, not the negligence cause of action that is the focus of this discussion.
Moreover, plaintiffs do not even mention the American Pharmaceutical Association Code
of Ethics in their response brief, and they cite to no South Carolina case law to suggest
that Walgreen Co. has any duty in this context. Finally, plaintiffs fail to cite to any South
Carolina law that applies the general proposition that anyone has a duty to exercise
reasonable care when his or her action creates a risk to others to this context. The court is
unconvinced that such a general application of basic negligence law would apply here.
Finally, to the extent plaintiffs are attempting to argue that Walgreen Co. has a common
law duty to maintain the privacy of plaintiffs’ PII, that argument directly contradicts the
Supreme Court of South Carolina’s holding that there is no common law duty of
confidentiality for pharmacists. Evans v. Rite Aid Corp., 478 S.E.2d 846, 848 (S.C.
1996).
To be sure, something like the American Pharmaceutical Association Code of
Ethics “may be a potential source of guidance on a pharmacist’s duty of care generally,”
Evans v. Rite Aid Corp., 324 S.C. 269, 273 (S.C. 1996); see also Madison ex rel. Bryant
v. Babcock Ctr., Inc., 638 S.E.2d 650, 659 (S.C. 2006) (“The standard of care in a given
case may be established and defined by the common law, statutes, administrative
regulations, industry standards, or a defendant's own policies and guidelines.”).
However, as previously explained, “if no duty has been established, evidence as to the
standard of care is irrelevant. Only when there is a duty would a standard of care need to
be established.” Doe ex rel. Doe, 711 S.E.2d at 912. Plaintiffs fail to sufficiently allege
any duty that Walgreen Co. owed to plaintiffs for which the standard of care would be
informed by professional standards. As such, this claim must be dismissed.

34

g. Negligence Based on PPA
Walgreen Co. argues that PPA does not establish a relevant duty of care, that PPA
does not give rise to a private cause of action, and that plaintiffs fail to plausibly allege
that Walgreen Co. violated PPA, meaning this claim should be dismissed. In their
response brief, plaintiffs clarify that this cause of action is based on a breach of a
standard of care set by PPA, not a violation of PPA. In other words, this cause of action
is not a negligence per se claim. However, as discussed above, plaintiffs’ theory of a
“breach of a standard of care” is not how negligence claims work. Something like PPA
may inform the standard of care, but there has to first be a duty. Once a duty is
established, the court looks to the standard of care, which could be informed by PPA, to
determine whether that duty was breached. In other words, a negligence claim is based
on a breach of a duty, which is informed by a standard of care, not based on a breach of a
standard of care. The sole case on which plaintiffs rely, Bibeau v. Shortt, clearly
considers violations of PPA in the context of a negligence per se claim. 2006 WL
8443485, at *9 (D.S.C. June 29, 2006) (“These acts violate clear safety standards
established in the Pharmacy Practices Act and each supports a separate finding of
negligence per se.”).
Plaintiffs argue that there are “PPA-established duties” but cite to no authority
suggesting that to be true. ECF No. 143 at 31. In fact, the Supreme Court of South
Carolina has held just the opposite. Evans v. Rite Aid Corp., 478 S.E.2d 846, 847 (S.C.
1996) (holding that PPA “do[es] not set forth, explicitly or implicitly, a duty of
confidentiality”). As such, even if PPA does inform the standard of care, plaintiffs point
to no duty that Walgreen Co. owed to plaintiffs, and this claim must be a negligence per

35

se claim for a violation of PPA if it has any hope of surviving. The problem with treating
this cause of action as one for negligence per se is PPA does not provide an explicit
private cause of action, and plaintiffs make no allegations or arguments that a cause of
action is implied based on the two-prong test: that “(1) the essential purpose of the statute
is to protect from the kind of harm the plaintiff has suffered; and (2) the plaintiff is a
member of the class of persons the statute is intended to protect.” Whitlaw, 410 S.E.2d at
252. Without any such allegations or argument, this claim fails. See Skinner v. Horace
Mann Ins. Co., 369 F. Supp. 3d 649, 655 (D.S.C. 2019) (dismissing a negligence per se
claim because the statute upon which the claim was based did not create a private cause
of action and the plaintiff made no argument that a private cause of action was implied).
h. Respondeat Superior and Negligent Training and Supervision
Walgreen Co. argues that these claims should be dismissed because the causes of
action underlying these claims fail. In response, plaintiffs argue that they have
sufficiently alleged these causes of action because they have alleged that Walgreen Co.’s
pharmacists-in-charge have allowed plaintiffs’ PII to be transferred out of the pharmacy
for unauthorized purposes, failed to establish policies and procedures to maintain the
confidentiality of plaintiffs’ PII, failed to maintain adequate security and systems
safeguards, and failed to implement and abide by the PIPA, PPA, American
Pharmaceutical Code of Ethics, and requirements set forth by the South Carolina Board
of Pharmacy, all of which occurred within their scope of employment. Am. Compl. ¶¶
255–56. Plaintiffs also allege that Walgreen Co. negligently failed to properly train and
supervise its pharmacists and pharmacists-in-charge with regard to how 340B Complete
operates. Id. ¶ 266.

36

Respondeat superior is not a cause of action; it is a theory of liability. See Austin
v. Specialty Transp. Servs., Inc., 594 S.E.2d 867, 877 (S.C. Ct. App. 2004) (“Under the
doctrine of respondeat superior, the employer is liable for the acts of an employee acting
within the scope of employment.”). Therefore, the court dismisses this cause of action.
With regard to the negligent training and supervision cause of action, “[a]n employer can
be liable for negligent supervision of an employee when an employee intentionally harms
another on the employer’s premises and the employer (i) knows or has reason to know
that he has the ability to control his employee, and (ii) knows or should know of the
necessity and opportunity for exercising such control.’” Thomas v. City of Mauldin,
2017 WL 4776972, at *6 (D.S.C. Sept. 26, 2017), report and recommendation adopted,
2017 WL 4764814 (D.S.C. Oct. 20, 2017) (cleaned up). “[N]egligent training is merely a
specific negligent supervision theory by another name.” Holcombe v. Helena Chem. Co.,
238 F. Supp. 3d 767, 772 (D.S.C. 2017). Plaintiffs do not allege that pharmacists
intentionally harmed plaintiffs, as is required for this cause of action. Degenhart v.
Knights of Columbus, 420 S.E.2d 495, 496 (S.C. 1992) (“An employer may be liable for
negligent supervision if the employee intentionally harms another . . . .” (emphasis
added)). Instead, plaintiffs allege that Walgreen Co. was negligent because of its
pharmacists’ alleged negligence, which is not the point of a negligent supervision and
training claim. Plaintiffs allege that Walgreen Co. intentionally does not disclose its
340B processes to pharmacists, Am. Compl. ¶ 262–65, but they do not allege that the
pharmacists are intentionally harming plaintiffs. As such, the court dismisses this claim.

37

i. Unjust Enrichment
Walgreen Co. argues that plaintiffs’ unjust enrichment claim should be dismissed
because plaintiffs have failed to show that Walgreen Co. has realized any benefit from
plaintiffs’ PII, to allege any harm, and to show that it would be unjust for Walgreen Co.
to retain that benefit. In response, plaintiffs argue that they have sufficiently alleged that
Walgreen Co.’s transfer of plaintiffs’ PII in furtherance of 340B Complete conferred a
benefit on Walgreen Co. in the form of additional profits, and that it is unjust for
Walgreen Co. to retain those profits because the transfer and use of plaintiffs’ PII was
without plaintiffs’ knowledge or consent.
“Unjust enrichment is an equitable doctrine which permits the recovery of that
amount the defendant has been unjustly enriched at the expense of the plaintiff.” Dema
v. Tenet Physician Servs.-Hilton Head, Inc., 678 S.E.2d 430, 434 (S.C. 2009). To
succeed on an unjust enrichment claim, a plaintiff must prove: “(1) [a] benefit conferred
by plaintiff upon the defendant; (2) realization of that benefit by the defendant; and (3)
retention of the benefit by the defendant under circumstances that make it inequitable for
him to retain it without paying its value.” Myrtle Beach Hosp., Inc. v. City of Myrtle
Beach, 532 S.E.2d 868, 872 (S.C. 2000). The South Carolina Supreme Court defines
benefits as ‘goods or services.’” Quintech Sec. Consultants, Inc. v. Intralot USA, Inc.,
2011 WL 5105446, at *4 (D.S.C. Oct. 27, 2011) (citing Gignilliat, 684 S.E.2d at 764).
Plaintiffs allege that Walgreen Co. “induced Plaintiffs and class Members to
provide their PII to its pharmacy in order to receive their prescription drugs” and that
Walgreen Co. “realized value from the transfer, receipt, and/or use, disclosure, or
dissemination of Plaintiffs’ and Class Members’ PII” because Walgreen Co. is

38

compensated for its 340B administration services through 340B Complete. Am. Compl.
¶¶ 275–77. The compensation allegedly occurs when the profit margin of a 340B drug
exceeds the fee that the Covered Entity paid to Walgreen Co. and Walgreen Co.
subsequently purchases the drug at the discounted 340B price. Id. ¶¶ 72–74.
The court begins with Walgreen Co.’s last argument because it is the one that
warrants dismissal of this claim. Walgreen Co. argues that plaintiffs have failed to allege
that a benefit was conferred in a circumstance in which it would be unjust for Walgreen
Co. to retain the benefit. Walgreen Co. relies on a Fourth Circuit case which states that
“three elements encompass the equitable remedy of unjust enrichment and quasi-contract:
the plaintiff must show that (1) he had a reasonable expectation of payment, (2) the
defendant should reasonably have expected to pay, or (3) society’s reasonable
expectations of person and property would be defeated by nonpayment.” Provident Life
& Acc. Ins. Co. v. Waller, 906 F.2d 985, 993–94 (4th Cir. 1990). As plaintiffs note, this
case applied federal common law unjust enrichment, not South Carolina law on unjust
enrichment. However, South Carolina law also clearly contemplates an expectation of
payment in unjust enrichment claims. See Quintech Sec. Consultants, Inc. v. Intralot
USA, Inc., 2011 WL 5105446, at *4 (D.S.C. Oct. 27, 2011) (dismissing unjust
enrichment claim in part because the plaintiff had no expectation of compensation);
Webb v. First Fed. Sav. & Loan Ass’n of Anderson, 388 S.E.2d 823, 827 (S.C. Ct. App.
1989), overruled on other grounds by Myrtle Beach Hosp., Inc. v. City of Myrtle Beach,
532 S.E.2d 868 (S.C. 2000) (“The case of Gantt v. Morgan, 18 S.E.2d 672 (S.C. 1942),
clearly implies that an expectation of payment is an element of a quantum meruit action
in South Carolina.”). Plaintiffs claim that they could not have reasonably expected

39

payment from the unconsented use of their PII because Walgreen Co. intentionally
concealed its conduct, but that argument simply goes to show that their unjust enrichment
claim is untenable. If they could not have reasonably expected payment, then they cannot
state a claim for unjust enrichment. Despite claiming that “[t]he facts of this case ‘fit the
archetypal unjust enrichment scenario,” ECF No. 143 at 35, plaintiffs fail to cite to any
unjust enrichment case with similar facts. Therefore, the court dismisses this claim.
j. Declaratory Relief
Walgreen Co. argues this claim should be dismissed because seeking declaratory
relief under 28 U.S.C. § 2201 is not an independent cause of action and because it is
premised on plaintiffs’ other failed claims. Walgreen Co. also argues that it should be
dismissed as inappropriate at this stage of litigation because the merits of plaintiffs’
claims have not been adjudicated yet. Plaintiffs “seek a judicial determination of whether
Walgreens has performed, and is performing, the privacy practices and obligations
necessary to protect and safeguard Plaintiffs’ and Class Members’ PII from further
unauthorized transfer, receipt, and/or use, disclosure, or dissemination.” Am. Compl. ¶
202.
The Declaratory Judgment Act states that
In a case of actual controversy within its jurisdiction . . . any court of the
United States, upon the filing of an appropriate pleading, may declare the
rights and other legal relations of any interested party seeking such
declaration, whether or not further relief is or could be sought.
28 U.S.C. § 2201. To determine whether a claim for declaratory judgment is properly
alleged, the court must ask “whether the facts alleged, under all the circumstances, show
that there is a substantial controversy, between parties having adverse legal interests, of
sufficient immediacy and reality to warrant the issuance of a declaratory judgment.”
40

MedImmune, Inc. v. Genentech, Inc., 549 U.S. 118, 127, (2007). “A case meets the
actual controversy requirement only if it presents a controversy that qualifies as an actual
controversy under Article III of the Constitution.” Volvo Const. Equip. N. Am., Inc. v.
CLM Equip. Co., Inc., 386 F.3d 581, 592 (4th Cir. 2004). “A ‘controversy’ in this sense
must be one that is appropriate for judicial determination.” Aetna Life Ins. Co. of
Hartford, Conn. v. Haworth, 300 U.S. 227, 240 (1937). “A justiciable controversy is thus
distinguished from a difference or dispute of a hypothetical or abstract character; from
one that is academic or moot.” Id.
Because the court dismisses all of plaintiffs’ other claims, plaintiffs have failed to
allege an “actual controversy” upon which the court could issue a declaratory judgment.
Plaintiffs allege that an actual controversy exists relating to “Walgreens’ failure to protect
Plaintiffs’ and Class Members’ PII in accordance with applicable state and federal laws
and agreements between the parties.” Am. Compl. ¶ 200. However, the court has found
that plaintiffs have failed to allege any violation of state or federal law or any breach of
an agreement between the parties. The “actual controversy” in plaintiffs’ declaratory
judgment claim is premised on their other claims, all of which are dismissed. Absent
sufficient allegations of wrongdoing, any declaration as to whether Walgreens was
sufficiently protecting plaintiffs’ PII would be abstract and hypothetical. As such,
plaintiffs have failed to allege an actual controversy, meaning their declaratory judgment
claim must be dismissed.

41

IV. CONCLUSION
For the reasons set forth above, the court GRANTS the motion.
AND IT IS SO ORDERED.

DAVID C. NORTON
UNITED STATES DISTRICT JUDGE
July 2, 2020
Charleston, South Carolina

42