Friday, December 7, 2018
Page 1
Ninth Circuit:
Facebook May Lawfully Track Visits to Healthcare Sites
By a MetNews Staff Writer
The Ninth U.S. Circuit Court of Appeals yesterday rebuffed the contention that Facebook’s collection of information on what healthcare-related sites a user visits violates various state and federal laws, including HIPPA.
A three-judge panel’s memorandum opinion affirms a dismissal, with prejudice, by District Court Judge Edward J. Davila of the Northern District of California, of an action filed by Winston Smith and two Jane Does.
The plaintiffs acknowledged that Facebook’s “Terms and Policies,” which include the right to collect data on what a user has viewed, “constitutes a valid contract.” Included is this language:
“We collect information when you visit or use third party websites and apps that use our Services ....This includes information about the websites and apps you visit, your use of our Services on those websites and apps, as well as information the developer or publisher of the app or website provides to you or us [and] we use all of the information we have about you to show you relevant ads.”
However, gathering information on visits healthcare sites, the plaintiffs argued, cannot reasonably be seen as being within the scope of the general consent because these visits are “qualitatively different” and of a “sensitive” nature.
Disagrees With Premise
The opinion responds:
“We do not agree that the collected data is so different or sensitive. The data show only that Plaintiffs searched and viewed publicly available health information that cannot, in and of itself, reveal details of an individual’s health status or medical history. Moreover, many other kinds of information are equally sensitive. We conclude that the practice complained of falls within the scope of Plaintiffs’ consent to Facebook’s Terms and Policies.”
The plaintiffs invoked the Health Information Portability and Accountability Act of 1996—generally referred to as “HIPAA”—as well as California Civil Code §1798.91, which requires written consent to use of medical information for direct marketing purposes. The opinion says:
“Information available on publicly accessible websites stands in stark contrast to the personally identifiable patient records and medical histories protected by these statutes—information that unequivocally provides a window into an individual’s personal medical history….Put simply, the connection between a person’s browsing history and his or her own state of health is too tenuous to support Plaintiffs’ contention that the disclosure requirements of HIPAA or section 1798.91 apply.”
Oral Argument
At oral argument on Oct. 16, the plaintiff’s attorney, Jason Barnes of New York, told the panel—comprised of Chief Judge Sidney Thomas, Circuit Judge Susan P. Graber, and District Judge Robert S. Lasnik of the Western District of Washington, sitting by designation—that it needed to view the consent to tracking in light of the “totality of circumstances.” He said that Facebook, in its privacy policy, tells users their privacy is important and they will be provided with disclosures to help them make choices.
That, he said, communicates to users that “Facebook is going to tell them those things that reasonable consumer would find important,” adding:
“We think it’s important that Facebook could be tracking communications with Healthcare providers.”
Arguing for Facebook, Lauren R. Goldman of Mayer Brown LLP’s New York office, said users’ privacy is, in fact, important to her client—which is why the privacy policy urges that users take cognizance of the terms of use, which includes reference to tracking.
The case is Smith v. Facebook, Inc., 17-16206.
Copyright 2018, Metropolitan News Company