Kaiser Website Privacy Claims ‘Don’t Apply’ to Qualtrics, Says Its Motion to Dismiss

Plaintiff Jane Doe’s May 15 class action “raises understandable concerns about nefarious companies” that steal sensitive user data, and then profit from selling or sharing that data, said Qualtrics’ motion Monday (docket 2:23-cv-00718) in U.S. District Court for Western Washington in Seattle to dismiss her complaint for failure to state a claim. But her concerns “don’t apply to Qualtrics, as her own complaint demonstrates,” said the motion.

The class action alleges Qualtrics and co-defendant Microsoft “repeatedly and systematically” violated patients’ healthcare privacy rights on the Kaiser Permanente website by intercepting and collecting patients’ data (see 2305160051). The complaint alleges the defendants used tracking code to unlawfully extract private healthcare and other information from Kaiser members’ interactions with the website. Microsoft is scheduled to file its answer to the complaint Thursday, after two deadline extensions.

Qualtrics “is just a vendor” that sells “tools” to customers like Kaiser, allowing those customers to collect and analyze “their own website data from their own website,” said its motion to dismiss. “Qualtrics does nothing with this data for itself,” it said. “Unlike other third-party data companies that have been the subject of recent litigation,” Qualtrics doesn’t sell user data, nor does it use the data for advertising or “for its own purposes,” it said.

Qualtrics’ business model is selling software services, not data, said the motion. Plaintiff Doe doesn’t and couldn’t allege “any facts showing that Qualtrics is anything other than Kaiser’s vendor,” it said. Qualtrics thus “stands in Kaiser’s shoes for all purposes” related to Kaiser customer data, it said. It’s not a “third-party interloper,” it said: “Courts regularly dismiss privacy actions against vendors like Qualtrics on these grounds.”

The Kaiser data alleged in Doe’s complaint is “anonymous,” said the motion. Doe doesn’t allege this data contains patients’ identities. Instead, as Doe notes, Qualtrics assigns a “randomized alphanumeric string” to all Kaiser website users. Though all of Doe’s claims are “premised” on the collection of her personal identifiable information, she doesn’t allege Qualtrics “collected anything that specifically and personally identifies” her, it said.

Since courts “regularly hold” that the collection of anonymized data isn’t an “injury in fact,” Doe lacks standing to assert her claims, said the motion. In an attempt “to plead around both problems,” the complaint “resorts to group pleading,” repeatedly making allegations about conduct by the two co-defendants, it said. But Qualtrics and Microsoft “are differently situated, and the law treats them differently as a result,” it said.

Doe, as a Kaiser member, “consented to the conduct about which she now complains,” said the motion. She can’t now “turn around and sue Qualtrics for obtaining data that she agreed Kaiser could share with Qualtrics,” notwithstanding her “general citations” to Health Insurance Portability and Accountability Act standards and unrelated litigation, it said. In addition to these “unsurmountable hurdles,” Doe’s complaint is “replete with legal defects that are fatal to her claims,” it said.

Doe’s class action hasn’t identified any injury in fact, and she therefore lacks standing to assert her claims, said the motion. She hasn’t identified “with any specificity” when she used the Kaiser website, it said. Based on the “limited allegations” she does make, “her claims appear untimely,” it said. She also hasn’t met “the fundamental pleading requirements of her claims,” it said. The statutes under which she sues are “largely inapt,” and don’t protect against “the type of harm she alleges,” it said.