Security, Privacy and The Law : Security & Privacy Lawyer & Attorney : Foley Hoag Law Firm : Boston, Washington D.C.

A decision in Tyler v. Michaels Stores earlier this month from the United States District Court for the District of Massachusetts, the use of a consumer's Zip Code to find her address and send her mailings was held to be a statutory violation, but did not give rise to a claim for damages.

Melissa Tyler brought suit against Michaels Stores for violation of Massachusetts General Laws, chapter 93, section 105(a) on behalf of herself and a putative class, claiming that Michaels illegally requested customers’ ZIP codes when processing their credit card transactions in violation
of the section 105(a).  She alleged that the violation of section 105(a) amounted to a per se violation of the Massachusetts Consumer Protection law, chapter 93A, section 9, caused unjust enrichment, and entitled Tyler to declaratory relief pursuant.

Judge Young found that "a ZIP code can indeed be personal identification information under
Section 105(a)" but that no harm resulted (that Ms. Tyler's receipt of advertisements for the store was not sufficient to constitute harm):

In the area of identity fraud, a judge in this district has similarly held that where there were no instances of actual data loss or misappropriation, the failure to comply with minimum
statutory security standards did not cause cognizable injury because the added risk of identity fraud did not actually cause harm to the plaintiff. Katz v. Pershing, LLC, Civil Action No.
10–12227-RGS, 2011 WL 3678720, at *4 (D. Mass. Aug. 23, 2011) (Stearns, J)....[R]eceiving unwanted commercial advertising through the mail is simply not an injury cognizable under chapter 93A, since Section 105(a) was enacted to prevent fraud.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

In Mercier v. Courtyard Nursing Care Center, 2009 WL 1873746 (Mass. Super. Ct. Jun. 11, 2009), a resident of a nursing home sued the home in Massachusetts Superior Court for negligence after being assaulted by another resident.  The injured resident moved to obtain medical records maintained by the home regarding the resident who had allegedly committed the assault.  The home contended that disclosure of the records would violate both HIPAA’s prohibition on disclosure of medical records without a patient’s authorization and Mass. Gen. L. ch. 93A, the Massachusetts unfair and deceptive practices statute.

The court, however, held HIPAA permitted disclosure of medical records “in the course of a judicial proceeding,” including in response to a court order, subpoena or discovery request. The court further observed that, although a Massachusetts regulation states that unauthorized release of a patient’s personal or medical record violates ch. 93A, the regulation contains a specific exception for disclosures “required by law.”  The court held that disclosure pursuant to a court order requiring production of records constituted such a disclosure.  The court also held that the sought-after records were likely to lead to admissible evidence regarding defendant’s knowledge of the alleged propensity for violence of the resident who had committed the assault and therefore ordered production of the records.  [Thanks to Foley Hoag's Eric Haskell for this entry.]

• Email This
• Print
• Comments
• Trackbacks
• Share Link