By: Quinn Novak,
If you Google the American Cancer Society and search through their website for information about breast cancer, do you have a reasonable expectation of privacy? Or do you expect that someone is monitoring your activity and collecting your medical searches? Winston Smith believed he had privacy when searching those types of medical websites for cancer information. Smith did not realize that Facebook collects his private medical information from well-respected cancer organizations[1] and uses that private health data to create marketing profiles, targeting him with tailored advertisements based on his private information.[2] When Smith discovered this reality, he initiated a class action lawsuit against Facebook and seven healthcare organizations, including the American Cancer Society, the American Society of Clinical Oncology, and the Melanoma Research Foundation.[3]
Smith filed the complaint on March 15, 2016 in a San Jose, federal court.[4] The case was assigned to Magistrate Judge Nathanael M. Cousins.[5] The three plaintiffs, including Smith, allege that the named defendants violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA), federal Wiretap Acts, and several state statutes.[6] According to HIPAA, because medical data is private, it should be difficult to acquire and companies are not allowed to gather or share medical information without express authorization of the patient.[7] Plaintiffs argue that because users have no idea that their information is being gathered and because Facebook does not disclose on its data and privacy policies that it tracks, collects, and intercepts users’ sensitive medical information and communications, Facebook and the named healthcare organizations violate HIPAA.[8]
Although it is evident that Facebook is harvesting cancer data to generate profit through targeted advertising,[9] it is unclear if the medical website owners have knowledge that Facebook is using their data.[10] However, if the healthcare organizations were aware that Facebook was collecting their user’s data, plaintiff claims that the organizations should have disclosed their relationship with Facebook to their users.[11]
Although Smith seeks certification, damages, restitution, and permanent injunction from all eight defendants, a Facebook spokesperson stated that the “Lawsuit is without merit and we will defend ourselves vigorously.”[12] In rebuttal, a representative from plaintiff’s counsel, Kiesel Law LLP, stated, “When you’re searching private medical information, you don’t realize it’s being sent to Facebook” and states that there is a reasonable expectation of privacy for these types of searches.[13] Fortunately, not all medical websites allow Facebook to track their user’s communications; the Mayo Clinic and Johns Hopkins Medicine website do not allow Facebook to mine their data through the use of cookies.[14] So, for now, if you need to search for medical information about cancer and you don’t want Facebook to keep track of that information, use one of the numerous protected websites. Otherwise, the next time you log onto Facebook, you can reasonably expect to see advertisements across your newsfeed catering to your cancer medical needs.
[1] See Bethy Squires, Facebook is Mining Private Data from Cancer Organizations, New Lawsuit Alleges, Broadly (Mar. 18, 2016, 4:15 PM), https://broadly.vice.com/en_us/article/facebook-is-mining-private-data-from-cancer-organizations-new-lawsuit-alleges.
[2] See Nicholas Iovino, Facebook Mines Data Off Cancer Sites, Users Say, Courthouse News Service (Mar. 16, 2016, 7:05 PM), http://www.courthousenews.com/2016/03/16/facebook-mines-data-off-cancer-sites-users-say.htm.
[3] See Carrie Pallardy, Lawsuit Claims Facebook Mined PHI from Websites of Cleveland Clinic, MD Anderson Cancer Center & More for Advertising Profit, Becker’s Health IT & CIO Review (Mar. 23, 2016), http://www.beckershospitalreview.com/healthcare-information-technology/lawsuit-claims-facebook-mined-phi-from-websites-of-cleveland-clinic-md-anderson-cancer-center-more-for-advertising-profit.html.
[4] See Smith et al v. Facebook, Inc. et al, PacerMonitor (Apr. 1, 2016, 12:07 AM), https://www.pacermonitor.com/public/case/10970091/Smith_et_al_v_Facebook,_Inc_et_al [hereinafter PacerMonitor]; see Neil Versel, Suit Claims Facebook Mines Private Cancer Data, MedCity News (Mar. 23, 2016, 1:21 AM), http://medcitynews.com/2016/03/facebook-cancer-data/.
[5] See PacerMonitor, supra note 4.
[6] See Versel, supra note 4.
[7] See Squires, supra note 1.
[8] See id.; see Iovino, supra note 2.
[9] See Iovino, supra note 2.
[10] See Squires, supra note 1; see also Versel, supra note 4 (stating that it is unclear whether cancer institutes named in the suit are aware of Facebook’s practices).
[11] See Pallardy, supra note 3.
[12] See Iovino, supra note 2.
[13] See Squires, supra note 1.
[14] See id.
Photo Source: http://www.valuewalk.com/wp-content/uploads/2015/02/Facebook-lawsuit.jpg