In the absence of a federal privacy law, it is left to individual states to introduce consumer privacy laws and ensure that companies that collect, process, and sell personal data are adequately protecting that information. While attempts to pass a federal data privacy bill have stalled, Republican and Democratic lawmakers are continuing to push for greater privacy protections for consumers.

Congresswoman Anna Paulina Luna Introduces U.S. Data on U.S. Soil Act

Congresswoman Anna Paulina Luna (R-FL) recently introduced the U.S. Data on U.S. Soil Act, to protect the data security of Americans and prevent their personal information from being exploited by foreign adversaries. It is no secret that foreign countries are attempting to collect and use the personal data of U.S. citizens. In March 2023, the House Committee on Energy and Commerce explored the role that social media, and specifically TikTok, plays in data collection and how the Chinese Communist Party has access to the data of U.S. citizens that is collected by TikTok, through TikTiok’s parent company, ByteDance.

The European Union has a comprehensive data privacy and protection law, the General Data Protection Regulation (GDPR), which protects the rights of individuals and limits the data that can be collected and used by companies such as TikTok, but there is currently no comparable federal privacy and data protection law in the United States, only a patchwork of laws introduced by individual states.

“Americans daily face the threat of exposing their personal data to bad-actor countries who are looking for a chance to exploit us, simply by opening our phones,” said Luna. “The protections in my bill are long overdue. A military leader would never hand over his tactics and intelligence to the enemy on a silver platter, and neither should we. My bill would make sure our adversaries can’t have a free-for-all with our personal lives, national security, and strength as a country.”

The U.S. Data on U.S. Soil Act seeks to prohibit companies such as TikTok from storing the data of any U.S. national in a physical data center that is located within a foreign adversary, including China, Cuba, Iran, North Korea, Russia, and Venezuela. The bill also seeks to prevent government officials in foreign adversary countries from accessing covered data. The bill would set a national minimum standard for data privacy and would not pre-empt state law, ensuring that individual states could implement more stringent data privacy protections. The bill would seek penalties of $50,120 per violation under the Unfair or Deceptive Act under the Federal Trade Commission Act. The bill, which currently has no companion Senate bill, was co-sponsored by Reps. Mary Miller (R-IL), Ralph Norman (R-SC), and George Santos (R-NY)

Democratic Senator Reintroduces Three Data Privacy Bills

U.S. Sen. Catherine Cortez Masto (D-NV) has recently reintroduced three bills that aim at strengthening consumer data privacy protections. The first bill, The DATA Privacy Act, is concerned with improving privacy protections for consumers and ensuring that large tech firms implement data security and privacy protections. The bill would give consumers the right to request, dispute the accuracy, and transfer or delete their personal data without retribution. All data collection, processing, storage, and disclosure would require three standards to be met:

• The data collected must be reasonable, and for a legitimate business or operational purpose that is contextual and does not subject an individual to unreasonable privacy risk.
• The data must not be used in a discriminatory way.
• And businesses must not engage in deceptive data practices.

The DATA Privacy Act would give new authority to state Attorneys General and the Federal Trade Commission (FTC) to impose civil penalties for violations.

Sen Cortez Mastro, along with Sen. Deb Fischer (R-Neb.), reintroduced The Promoting Digital Privacy Technologies Act, which requires the National Science Foundation (NSF) to support research into privacy-enhancing technologies (PET) to help protect consumer data. The bill also calls for the National Institute of Standards and Technology (NIST) to work with academic, public, and private sectors to establish standards for the integration of PET into business and government.

The third bill, like the U.S. Data on U.S. Soil Act, takes aim at the collection, access, and use of consumer data by foreign adversaries, specifically China. The Internet App ID Act aims to improve the digital security of Americans by requiring operators of Internet websites and mobile applications to disclose if the applications being used by consumers have been developed or store data within China, or are under the control of the Chinese Communist Party.

“Big technology companies are collecting massive amounts of Americans’ personal information, from social security numbers to health care data. It’s clear we need stronger privacy laws to make sure this information isn’t shared or sold without consumers’ permission,” said Sen. Cortez Masto. “My bills will hold corporations and foreign actors accountable, protect the data privacy of vulnerable consumers, and ensure that our emerging AI and other innovative technology industries grow responsibly.”

The post Republicans and Democrats Introduce Bills to Improve Consumer Privacy Protections appeared first on HIPAA Journal.

Costco is one of the latest companies to be sued over the use of website tracking technologies. Many retailers use tracking code on their websites such as Meta Pixel and Google Analytics to gain information about the interactions of website visitors. These tools provide valuable information that can be used to improve websites and increase sales. The data collected by these tools is sent to the providers of the code, and in some cases, may be used to serve targeted advertisements.

Two lawsuits have recently been filed against Costco Wholesale over the use of these trackers on the Costco Pharmacy pages of the Costco website, which has allegedly impermissibly disclosed information protected under the Health Insurance Portability and Accountability Act (HIPAA).  Both lawsuits claim that Costco encourages patients and prospective patients to use its pharmacy webpages, communicate about their prescriptions, conduct research on medications, order new prescriptions, request refills for current medications, inquire about specific immunizations, search for local Medicare supplemental insurance, and sign up for its Rx mail order program.

However, unbeknown to website visitors, their activities are being tracked and their sensitive data is being transferred to third parties. The information transferred is tied to individuals by identifiers such as their IP address and Facebook ID and allows the third parties to infer that an individual is being treated for a specific type of medical condition such as cancer, pregnancy, HIV, mental health conditions, and they may be serviced targeted advertisements based on that information. Both lawsuits were filed in the U.S. District Court for the Western District of Washington at Seattle (R.S. v. Costco Wholesale Corporation and Castillo et al v Costco Wholesale Corporation). The lawsuits make similar claims, that the use of the tracking code without obtaining consent violates HIPAA, the Federal Trade Commission (FTC) Act, and federal and state wiretapping laws.

As a pharmacy operator, Costo is a HIPAA-covered entity and is required to comply with the HIPAA Rules. In December 2022, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued guidance on HIPAA and website tracking technologies, prohibiting the use of these tools unless consent was obtained – in the form of a HIPAA-compliant authorization – or a business associate agreement was in place with the providers of these tools. Most providers of tracking technologies do not sign business associate agreements. The FTC has taken action against non-HIPAA-covered entities that have used tracking code on websites that collects and discloses health data for violations of the FTC Act. The FTC and OCR jointly sent letters to 130 entities this year warning them about the use of tracking tools on their websites and the compliance risks associated with these tools. The guidance issued by OCR makes it clear that the use of these tools violates HIPAA; however, that position is being challenged by the American Hospital Association and others who recently filed a lawsuit against the Secretary of the HHS and the Director of OCR that seek confirmation from the court that the guidance is unlawful and to prevent OCR from ever enforcing it.

The two lawsuits seek class action certification, a jury trial, financial damages for the imminent and ongoing harm caused, and injunctive relief prohibiting Costco from using these tools and engaging in further unlawful behavior. These are just two of many lawsuits that have been filed against healthcare organizations and Meta over these tracking tools, which have disclosed the data of tens of millions of individuals to third parties without consent. Recently, Advocate Aurora Health settled its Pixel-related class action lawsuit for $12.225 million.

Plaintiffs and class members in the R.S. v. Costco lawsuit are represented by Kim D. Stephens & Rebecca L. Solomon of Tousley Brain Stephens PLLC, and Gary M. Klinger, Alexandra M. Honeycutt & Glen L. Abramson of Milberg Coleman Bryson Phillips Grossman PLLC. Plaintiffs and class members in the Castillo et al v Costco lawsuit are represented by Kim D. Stephens & Rebecca L. Solomon of Tousley Brain Stephens PLLC and Ryan J. Ellersick and Hart L. Robinovitch of Zimmerman Reed LLP.

The post Costco Pharmacy Patients Sue for Website Tracking Technology Disclosures of PHI to Third Parties appeared first on HIPAA Journal.

On Friday, an Idaho federal court unsealed a Federal Trade Commission (FTC) amended complaint against the Idaho-based data broker Kochava, which the FTC alleges collected and disclosed enormous amounts of sensitive consumer data in violation of federal law.

The FTC filed its first complaint against Kochava in August 2022, which alleged Kochava was acquiring consumers’ precise geolocation data and was selling the data in a format that allowed entities to track consumers’ movements to and from sensitive locations, including but not limited to, medical centers, reproductive healthcare facilities, places of worship, mental health facilities, temporary shelters such as centers for survivors of domestic violence, and other sensitive locations, such as addiction recovery centers.

The FTC said Kochava sold access to its data feeds on online data marketplaces that are publicly accessible. Customers who pay a monthly subscription fee can access its location data feed, and a free sample containing a subset of the data feed was available free of charge, with minimal requirements for accessing the sample and no restrictions on usage. The FTC alleged that Kochava’s business practices cause and are likely to cause substantial injury to consumers, such as allowing individuals to be located who had visited abortion clinics.

The FTC alleged Kochava’s business practices violated Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), which prohibits unfair or deceptive acts or practices in or affecting commerce. Acts or practices under Section 5 of the FTC Act are unfair if they cause or are likely to cause substantial injury to consumers, that consumers cannot reasonably avoid themselves, and that is not outweighed by countervailing benefits to consumers or competition.

Kochava moved to have the initial lawsuit dismissed, and on May 4, 2023, the lawsuit was dismissed by Judge B. Lynn Winmill of the US. District Court for the District of Idaho, as the FTC was determined to have relied too much on the inference that consumers are injured by the data broker’s business practices. The FTC was allowed 30 days to file an amended complaint, as the FTC’s concerns about consumer privacy were found to be legitimate. The amended lawsuit was filed under seal on June 5, 2023, and was three times as long as the initial complaint and ran to 33 pages.

The amended lawsuit includes details about the alleged violations not stated in the first lawsuit. Kochava is alleged to have collected and disclosed precise geolocation data, including details of consumers’ movements, such as visits to sensitive locations. In some cases, geolocation data spans days, months, and even years. In some cases, Kochava linked the geolocation data with other sensitive consumer data, such as name, gender, age, ethnicity, yearly income, marital status, education level, political affiliation, apps installed on users’ mobile devices, interests, behaviors, Mobile Advertising ID, and contact information, which may include address, phone number, and email address.

According to the FTC, the data accessible to Kochava customers allowed individuals to be tracked and served targeted ads. Kochava offered the data in several formats, including a Kochava Collective product, which includes precise geolocation data. This product included granular facts about users, including precise geolocation data, allowing precise targeting of those individuals, and Kochava is alleged to have advertised that product as such.

The FTC alleged the data would allow individuals who received an abortion or were planning on having an abortion to be tracked. The FTC provided an example from the free sample offered by Kochava, which included the data of a woman who visited an abortion clinic. The FTC was able to trace that visit to a mobile device in a single-family residence, and the mobile device was present in the same location three times in one week, allowing the user’s routines to be determined. The FTC alleges that in addition to allowing individuals to be targeted who have sought reproductive care, providers who offer reproductive health services could also be tracked and targeted.

It remains to be seen if the amended lawsuit sufficiently alleges that individuals are likely to suffer substantial injury as a result of Kochava’s business practices, and whether invasion of privacy constitutes an unfair practice under the FTC Act. In the absence of a federal privacy law, the FTC is in the best position to hold companies to account that are determined to have violated consumer privacy. While there have been bipartisan efforts to introduce a federal privacy law, all efforts thus far have failed to get the necessary backing. Earlier this year, three Democratic Senators proposed a bill that would prohibit sensitive health data from being used for advertising purposes. The proposed bill,  The Upholding Protections for Health and Online Location Data (UPHOLD) Privacy Act, sought to prevent data brokers such as Kochava from selling geolocation data and to limit the ability of companies to collect and use personal health information without express consent from consumers.

The post Federal Judge Unseals FTC Amended Complaint Against Kochava appeared first on HIPAA Journal.