Facebook Cancer Patient Spying Case Lands at Ninth Circuit

SAN FRANCISCO (CN) – A Ninth Circuit panel gave little indication Tuesday whether it will revive a proposed class action accusing Facebook of spying on cancer sufferers to target them with medical advertising.

U.S. Circuit Court Chief Judge Sidney Thomas peppered Facebook’s lawyer with questions hinting that he was undecided about whether user information – such as searches for medical terms – collected by Facebook from healthcare and nonprofit websites is protected from disclosure under the Health Insurance Portability and Accountability Act (HIPAA).

But U.S. Circuit Judge Susan Graber appeared to side firmly with the social media company’s contention that the information is generic and consequently not protected under the 1996 statute enacted to safeguard patient medical information.

“If I were a journalist and I wanted to write an article about stomach transplants, heart transplants – I would visit all those websites,” Graber told plaintiffs’ counsel Jay Barnes, who is with Barnes & Associates in Jefferson City, Missouri. “It isn’t necessarily private information in the way you’re describing.”

Lead plaintiff Winston Smith sued Facebook, the American Cancer Society, the American Society of Clinical Oncology, and five other cancer care providers and organizations in March 2016, claiming Facebook collects private user information from their websites, including whether a user clicked on Facebook “like” or “share” buttons embedded on the sites.

Smith claims the information lets Facebook identify individual users and track the specific website pages they visit. He says the company uses the data to sell targeted medical advertising to third parties, in violation of the federal Wiretap Act, the California Invasion of Privacy Act and other statutes.

U.S. District Judge Edward Davila in San Jose dismissed the case in May 2017 because the plaintiffs consented to Facebook’s privacy policy, which notifies users when setting up an account the company collects information from third-party websites.

He also rejected Smith’s argument the information in question is protected under HIPAA.

On Tuesday, Barnes argued that whether or not the information is legally protected, no “reasonable user” reading Facebook’s privacy policy would assume Facebook tracks communications with healthcare providers “who expressly promised to keep them private.”

But Graber said the plaintiffs’ issue seemed to be with the healthcare defendants – which weren’t included in the appeal.

“That’s really your beef, it’s with the medical providers that ought not be putting this stuff out on Facebook where it can be shared,” Graber said. “It strikes me that if there’s a problem, it isn’t with Facebook; it’s with the healthcare providers.”

Goldman, Facebook’s attorney, countered the company’s data policy does in fact tell users it collects information about them “on and off Facebook.”

“Facebook is describing exactly what the plaintiffs are claiming it did in this case,” said Goldman, who is with Mayer Brown in Los Angeles. “Facebook is saying we received this information and this is how we are using it.”

Echoing Barnes, however, Thomas said if the information is protected under HIPAA, users have a “reasonable expectation” the information will be kept private, given Facebook’s privacy policy.

Thomas also appeared concerned that Facebook allows users to restrict the information it collects about them but not to opt out of collection completely.

“If this court rules in Facebook’s favor, it is giving it a blank check to collect anything and everything it wants, regardless of any contrary privacy promises, regardless of any laws to the contrary,” Barnes said.

Facebook had no immediate comment Tuesday.

U.S. District Judge Robert Lasnik of the Western District of Washington joined the panel, which did not indicate when it will rule.

%d bloggers like this: